Government failings exacerbated 2023 breach, says N.S. privacy commissioner
Nova Scotia's information and privacy commissioner says the provincial government did not have reasonable security and information practices in place before a massive security breach in 2023 involving a file transfer service.
Tricia Ralph released her investigation report into the MOVEit privacy breach on Wednesday, finding that the province's protocols before the breach exacerbated the impact of the cybersecurity attack, and some of its actions afterward increased stress for the victims.
"We, as citizens, must demand more of the public institutions that collect personal information about us," Ralph said in a news release about her report. "Real leadership at the highest level in the Nova Scotia government is needed to ensure that adequate security and information practices, which are required by law, are implemented."
The breach came to light in June 2023 and the Nova Scotia government held a rare Sunday afternoon news conference to alert the public of a "global cybersecurity issue" that resulted in the theft of personal information.
The cybersecurity attack was part of a huge global breach involving MOVEit, a file transfer service used by the public and private sector to share personal information. The breach affected an estimated 18.5 million people worldwide.
100,000 Nova Scotians affected
At the time, Colton LeBlanc, the minister responsible for cybersecurity and digital solutions, told reporters the government didn't know how many Nova Scotians were affected or what information was stolen.
In the following days, it became clear that about 100,000 Nova Scotians were affected, including current or past employees of Nova Scotia Health, the IWK and the provincial civil service. The stolen information included banking details, home addresses and social insurance numbers.
Later, additional affected groups were identified by the government, including newborns, students, people who received parking tickets, and teachers, among many others.
Nova Scotia's information and privacy commissioner launched her investigation into the breach that December.
Report findings
Ralph's report says basic practices — such as completing a privacy impact assessment, a tool that identifies risks of a system — were not implemented and the government was therefore not in compliance with the Freedom of Information and Protection of Privacy Act or the Personal Health Information Act.
The government did not tell users of the MOVEit system how long they should keep files in it, the report says, and MOVEit ended up being used as a "repository for extraneous records." The retention of those unnecessary records in the system made the extent of the breach significantly worse, Ralph's report says.
Ralph found that in the wake of the breach, some of the province's actions were reasonable, such as notifying affected people quickly and offering credit monitoring for five years.
But she said the notification letters to breach victims did not have enough information, adding to their stress and worry. The government's contact information for victims was also outdated, so many did not even receive notification and could not take steps to protect themselves.
The Office of the Information and Privacy Commissioner received 110 complaints from Nova Scotians about the breach.
Commissioner's recommendations
Ralph issued eight recommendations in her report, including that the government specify the maximum time that files can remain in the MOVEit system, that it monitor the use of MOVEit at least yearly, and that it make public the appropriate portions of its privacy impact assessment on MOVEit.
Ralph also recommended that the government consult with the Office of the Information and Privacy Commissioner before issuing any future privacy breach notification letters, and make every effort to update the contact information the government holds on residents.
Hashtags
Try Our AI Features
Explore what Daily8 AI can do for you:
Comments
No comments yet...
Related Articles
CTV News
2 hours ago
- CTV News
As N.S officials discuss $4.5B hospital expansion, CEO says a new one likely needed, too
Karen Oldfield, the interim president and CEO of Nova Scotia Health, speaks to reporters after appearing before the province's public accounts committee where healthcare facilities were top of mind. (CTV Atlantic/Callum Smith) Officials in charge of the $7.4-billion QEII Halifax Infirmary expansion and maintenance project appeared before a legislative committee on Wednesday, offering some details – but not others – about where the project stands and where it's heading. During those discussions though, Karen Oldfield, the interim president and CEO of Nova Scotia Health, said a new hospital may also be required in the coming years. 'I don't want to presuppose an outcome, but I would be shocked if there was not some indication of another major or regional hospital being required in the Central Zone over the course of the planning horizon,' Oldfield said. 'I'm not announcing that, I'm not saying that,' she said. 'I'm intuiting that.' The population growth, particularly in the HRM, 'makes it very necessary to figure out just how we're going to build out the Central Zone,' she continued. But building is only part of the battle. She acknowledged staffing, timing and budgeting are only some components that need to be considered as part of the health authority's master plan. While speaking to reporters, Oldfield said several population factors will put even more pressure on the system. 'We're almost in a race against time to prepare for that peak to have the healthcare facilities ready, to have long-term care facilities ready. 'It's the demographics, it's the age, but it's also the baby boom that's hitting – I think it peaks out at 2035 – where a significant percentage of Nova Scotians are over age 65, and then it comes back down again,' Oldfield said. Acknowledging that a larger percentage of an aging population will likely lead to higher healthcare needs and long-term care needs. Oldfield said when she was appointed to her role by Premier Tim Houston in 2021, Nova Scotia Health did not have a 10-year capital plan, which makes it 'very difficult to plan when you don't have a long-term plan.' Construction update Oldfield said the QEII Halifax Infirmary expansion project's design phase is nearly 75 per cent completed, 'and that work is being shaped by those who use the spaces every day.' The first two cranes arrived last month and two more will arrive later this summer as part of the largest infrastructure project in the province's history. Construction crews started pouring the foundation last month and the concrete structure will rise to the main floor in December, 'marking a significant milestone,' said David Benoit, the CEO of Build Nova Scotia. Benoit reiterated numerous times to the Standing Committee on Public Accounts that the $7.4-billion price tag – including $4.5-billion in construction costs and $2.9-billion for 30-year maintenance costs – is part of a 'firm fixed price and schedule.' 'If things arise, like tariffs or hurricanes, or unexpected, unforeseeable things, there are clauses in the contract which allow for a conversation to happen,' he said. 'I'm comfortable that we got value for money, but you don't have to take my word for it,' Benoit told the committee. He told reporters a long-awaited 'value for money' document will be released to the public, likely within 'days.' When asked how tariffs could impact costs, John Volcko, PCL Constructors vice president of corporate development, said they learned a lot about price volatility and escalation during the COVID-19 pandemic. 'Within our bid, we've got certain allowances, certain contingencies to deal with unexpected things like that,' he told reporters. Interim Liberal leader Derek Mombourquette asked that the contract between the province and Plenary PCL Health (PPH) be tabled at the committee. The expansion will see a new, modern, 14-floor acute care tower with 216 beds, 16 operating rooms, a 48-bed intensive care unit and an emergency department that is nearly twice the size of the current one. It is expected to open in 2031. It's still not clear how many new staff will be needed and how many will come over from the Victoria General (VG) Hospital. Hotel rooms required At the construction peak for the QEII Halifax Infirmary project, there will be 850 to 1,000 workers, Volcko said. About two-thirds of those will be from Nova Scotia and the rest will come from out-of-province 'where there's just not sufficient skilled labour.' In response to a question from the NDP and Liberals, Benoit said there are ongoing discussions with Nova Scotia Community College about the void. For those workers coming from away, Volcko said 'there just was not sufficient time to put up a temporary lodging.' He said all 238 rooms at the Atlantica Hotel will be taken up by workers at some point. 'It's expected eventually we'll take over all the rooms and then there will be a tail where we don't need all the rooms again,' he told reporters. He couldn't say how many more rooms may be needed because he's not sure how many workers will be from out of town. 'Our first objective is to employ local talent, local skilled labour,' Volcko said. 'If our peak is in three years, you know, we've got some time to build a workforce.' Karen Oldfield Karen Oldfield, the interim president and CEO of Nova Scotia Health, speaks to reporters after appearing before the province's public accounts committee where healthcare facilities were top of mind. (CTV Atlantic/Callum Smith) For more Nova Scotia news, visit our dedicated provincial page
CBC
a day ago
- CBC
N.S. wants to go 'back to the table' on federal pharmacare deal
An official with Nova Scotia's Health Department says the province wants to get back into negotiations with the federal government on a pharmacare agreement. Stacy Burgess, executive director of clinical care and delivery, made the comments at a meeting of the standing committee on health at Province House on Tuesday. "Health Canada is aware that we want to come back to the table for further discussions, so we're waiting for that invite," she told reporters following the meeting. She said she couldn't provide any details about past negotiations as she isn't directly involved in the work. The Trudeau Liberal government passed legislation last year for a universal pharmacare program. However, since health care falls under provincial and territorial jurisdiction, each province and territory must sign an agreement with Ottawa to tap into the program. British Columbia, Manitoba, Prince Edward Island and the Yukon have signed agreements for the first phase of national pharmacare, which includes coverage for diabetes medication and some prescription contraceptives. Pharmacist Kari Ellen Graham said signing a deal is a "no-brainer." Graham is the founder of Access Now Nova Scotia, a group that advocates for free birth control, and was a witness at the health committee meeting. "Unfortunately Nova Scotia is lagging behind a little bit right now, but I was very encouraged with the conversations that we had in the legislature," she told reporters. 'Completely aligned,' government MLA tells advocates Graham pointed to comments from some government MLAs who expressed support for universal contraceptive coverage. "I sit here as a Nova Scotian, as a woman, completely aligned with the case you've made," Progressive Conservative MLA Susan Corkum-Greek told the panel of witnesses. She said the government is "very interested" in reaching a pharmacare deal and doesn't want to leave money on the table. But Corkum-Greek also expressed some hesitancy. She hearkened back to the federal-provincial funding arrangement on child care, which the previous provincial Liberal government signed. Corkum-Greek said the deal was "short-sighted" in leaving out private child-care providers. The Progressive Conservative government has since tried unsuccessfully to reopen the child-care deal with Ottawa. "It does highlight that the devil truly is in the details," said Corkum-Greek. Corkum-Greek would not agree to an interview after the committee meeting. Holding out for 'best deal' Burgess said the department will be looking to get "the best deal," which she described as one that is financially responsible, doesn't interfere with any existing programs and ensures long-term funding. The other pharmacare deals are for five years. Graham said she's also hoping for a good deal, but she doesn't think that means Nova Scotia should wait any longer. "We've put decades of research into this and, really, it's a no-brainer.… We need to step up, we need to move forward." She said she hopes Nova Scotia will push for more contraceptive coverage than the other provinces and the Yukon got. The four pharmacare deals that have already been struck all include the same suite of contraceptives — mostly hormonal pills and intrauterine devices, or IUDs. Graham said at least a half-dozen options are left out of those deals. "We'll be looking for all contraceptives to be on the list," she said.
CTV News
a day ago
- CTV News
Patient missing in Guysborough County: Nova Scotia Health
Nova Scotia's health authority is advising the public about a missing patient. Nova Scotia Health says Barrett Fraser is missing from an address in Guysborough County. The 43-year-old is described as being five-foot-nine and weighing 214 pounds. He also has short brown and grey hair and a brown and grey beard. The health authority says the risk to himself and others increases the longer he is away from treatment. Anyone with information on his whereabouts is asked to contact their local law enforcement agency. For more Nova Scotia news, visit our dedicated provincial page
