FNHA releases further information on cybersecurity incident to First Nations people

Press Release

Unceded territories of the xʷməθkʷəy̓əm (Musqueam), Sḵwx̱wú7mesh (Squamish) and səlilwətaɬ (Tsleil-Waututh) Nations |VANCOUVER – The First Nations Health Authority (FNHA) has concluded its investigation of a cybersecurity incident that occurred on May 13, 2024, and is notifying First Nations people in BC if and how they have been impacted.

In addition to notifying First Nations people of the impact to their personal information, the FNHA will be oﬀering appropriate supports, including live support through a Cyber Incident Support Centre.

“Upon discovery of unauthorized access to the FNHA network, our teams immediately deployed technological countermeasures to secure our ﬁles, systems and network from further attack,” said Richard Jock, CEO of the FNHA. “We then retained third-party cybersecurity experts to assist in containing, investigating and recovering from this incident.”

Through the investigation, the FNHA and its third-party experts identiﬁed a number of impacted ﬁles containing personal information. These ﬁles were reviewed using both technological and manual processes, which required time and attention to detail, to identify all of the people aﬀected and the nature of the impacted personal information. A copy of the full notiﬁcation letter can be found here. A detailed Q&A document has been posted here.

The investigation conﬁrmed the following groups of people have or may have had their personal information impacted:

Current (hired before May 13, 2024) and certain former employees of the FNHA (those who received a T4 tax form for the years 2021-2023);
First Nations peoples who live or have recently lived in British Columbia (BC) and who have a Certiﬁcate of Indian Status card;
First Nations peoples and their immediate non-First Nations family members who lived on reserve or in First Nations communities in BC on or before March 29, 2016 and who had one or more Tuberculosis screening tests prior to that date;
Individuals who have ﬁled compliments or complaints, or who have had a compliment or complaint ﬁled on their behalf, with the FNHA’s Quality Care and Safety Oﬃce, or with another provincial health authority’s Patient Care Quality Oﬃce where that compliment or complaint was shared by or with the FNHA’s Quality Care and Safety Oﬃce between January 1, 2020 – May 13, 2024.

Although the impact of the cybersecurity incident is not the same for everyone, the attackers were able to access the following types of information:

First and last names;
In some, but not all cases, personal contact information such as home address; home or mobile phone number; email address;
Demographic information such as date of birth and gender;
Certiﬁcate of Indian Status Card number;
Personal Health Number;
Health insurance plan eligibility information (e.g. MSP, Paciﬁc Blue Cross);
Paciﬁc Blue Cross health insurance claims information, including nature of claims and claims costs;
Tuberculosis screening test results for those living on reserve or in First Nations communities in BC and who were tested on or before March 29, 2016; and
Information about compliments or complaints ﬁled with or managed by the FHNA.

The FNHA has arranged to provide a credit monitoring and identity theft restoration service for a period of 24 months at no cost to anyone whose status number has been impacted by the cybersecurity incident. Additionally, a dedicated FNHA Cyber Incident Support Centre is available to people who may have questions not answered in the FNHA’s frequently asked questions page.

To reach the Support Centre by telephone, please call 1-844-723-6518. The operating hours of the Support Centre are 7:00 am – 3:00 pm Paciﬁc time, Monday to Friday. To reach the Support Centre by email, please contact cyberincident@fnha.ca. Emails can be sent at any time and a representative will respond within 48 hours of reading it during the Support Centre’s operating hours.

The FNHA has always taken information security very seriously, and as a result was able to detect and interrupt this cybersecurity incident while it was in progress in order to limit the ultimate impact. Despite having robust security measures in place, the FNHA knows that cyber threats continue to evolve and that information security is an ongoing commitment.

“As cybersecurity threats become more persistent and increasingly sophisticated, information security continues to be a top priority for the FNHA,” said Jock. “We take a continuous improvement approach to ensure that our security measures keep pace with both known threats and new threats as they emerge. The FNHA commits to communicate such occurrences to the people we serve and to our system partners.”

To learn more about mental health support services available to you, visit:

Media Contact:

First Nations Health Authority
Media Relations
604 329-9544
media@fnha.ca

Additional information: FNHA cybersecurity notification

If your Status Number has been compromised, you may be at risk of identity theft. As a protective measure the FNHA is oﬀering to provide eligible individuals with a free two-year subscription to Equifax Complete™ Premier, a premium credit monitoring and identity theft prevention service. Key features of this service include the following:

Daily monitoring and alerts for any changes to your Equifax credit report and score;
Up to $1 Million Identity Theft Insurance;
Dedicated ID restoration specialists will work on your behalf to help you recover from ID theft;
Dark web internet scanning will alert you if the information you provide is found on the dark web; and
Lost Wallet Assistance will help cancel and reissue lost bank/credit cards and government-issued ID.

To be eligible for the Equifax Complete™ Premier service, your Status Number must have been impacted by this cyber attack, you must be over the age of 18, and you must have a Canadian credit ﬁle.

To determine whether your Status Number has been impacted, please visit www.fnha.ca/cyberincident and click on the icon that reads “Am I eligible for credit monitoring?”. Please follow the instructions given. If, after following these instructions, you receive an Activation Code and a link to the Equifax Complete™ Premier enrolment website, this means that your Status Number was impacted. Please note that you have until January 31, 2025 to determine your eligibility.

Once you have your Activation Code, proceed to the Equifax Complete™ Premier enrolment website, www.equifax.ca/activate, to complete your enrolment form. This website is managed by Equifax, and FNHA has no access to the information you provide to Equifax.

Select one of the two options:

If you are an existing myEquifax user:
Use the link to sign into your account to redeem your unique Activation Code.
If you are new to myEquifax and need to create an account:
Enter and submit your unique Activation Code to begin, then follow the instructions to create your myEquifax account and complete your enrolment.
Please note that you have until February 28, 2025 to complete your enrolment, after which your Activation Code will expire.

If you have received an Activation Code, but are having diﬃculty enrolling in the Equifax Complete™ Premier service, please contact the Equifax Customer Care Centre at 1-800-395-5920

for assistance. The Equifax Customer Care Centre’s operating hours are 6:00 am – 6:00 pm PST, Monday to Friday, and 6:00 am – 3:00 pm PST, Saturday and Sunday.

Unfortunately, FNHA cannot create an Equifax Complete™ Premier account on your behalf. Additional steps you can take to protect yourself include:

If you are eligible for credit monitoring and identity theft services, activate your account;
Regularly (at least once per month) monitor your ﬁnancial account statements (e.g. bank accounts, credit cards, investment accounts, etc.) for unusual activity and immediately report unusual activity to your bank or credit card company;
Order and review a copy of your credit report from Equifax and TransUnion (which you can do for free once a year) and contact them if your credit report lists any accounts you did not open or inquiries from creditors that you have not authorized to access your credit report;
Be alert to any unusual or suspicious email or telephone communications that you might receive and do not provide your passwords or banking PINs to anyone. Do not provide anyone who calls or emails you with any other type of your personal information unless you are absolutely certain who you are communicating with;
If you haven’t changed your passwords on your various accounts in a long time, change them now. Use complex passwords that include letters, numbers and symbols. Do not use the same password across multiple accounts (e.g. email, online bank accounts and social media accounts);
Do not open attachments or click on links in emails that you aren’t expecting to receive, even if they look like they are coming from someone you know. If possible, call the person and conﬁrm that the email is valid. Do not call a number that is set out in an email if you don’t recognize that number. Look up the number in a separate directory; and
If you conﬁrm that you are the subject of identity theft, promptly report this to your local police and obtain the police ﬁle number.

ILR4