Officials still investigating what led to cyber incident at London health unit

Officials at the Middlesex London Health Unit (MLHU) say it could take weeks to determine what led to a cybersecurity incident that forced it to shut down a number of its systems on Friday.

The health unit's CEO Emily Williams had few details to provide at a media briefing on Monday but said an investigation is underway and it's unclear yet whether any patient data was compromised.

"We take our role as stewards of sensitive information very seriously. We know that an event like this one, a cyber security incident is unsettling," said Williams.

"The team is working hand in hand with cyber security experts, law enforcement and other agencies to understand what happened, reduce further risks and restore the services you expect from us."

On Friday afternoon, the health unit issued a press release saying it took some affected systems offline, including its regular phone lines and many of its software systems after it learned of the security incident a day earlier. MLHU said it reported the incident to Ontario's privacy commissioner and health ministry.

Several computer and phone systems were restored over the weekend, Williams said, adding that not all software systems are operational yet. MLHU is working with cyber security experts from CFC Response and Norton Rose Fulbright, along with external legal counsel, said Williams.

Williams did not say whether the incident was a ransomware attack, citing the sensitive nature of the ongoing investigation. She also couldn't provide estimates on how much the investigation and mitigation steps will cost since it's early in the process, she said.

"We're undergoing a thorough review and validation process to identify what if any data was impacted. If our investigation determines that there was any impact to personal data, we will reach out accordingly," she said.

Local services fighting 'uphill battle,' says expert

An organization's vulnerability to cyberattacks depends on its overall cyber setup, but smaller public organizations like health units have an "asymmetrical disadvantage" against highly-skilled hackers, said Aleksander Essex, a software engineering professor at Western University.

Small municipal organizations generally don't have the cyber sophistication and protection of federal agencies, he said, adding that forensic investigations for cyber incidents can cost hundreds of thousands of dollars.

"Which is unfortunate because as a public institution, it's already kind of stretched thin from a financial perspective and so this funding then goes into remediation instead of delivering health services," he said.

"My sympathy goes out to these municipal and local services who are fighting an uphill battle in the cyber landscape against people that are opportunistic and they either get lucky or they're very sophisticated. It's kind of an unfair fight."

Essex suspects the health unit will have to do a "system scrub down" to find and remove any malware that might be there and then do a root cause analysis to figure out how the cyber incident took place.

After this, MLHU officials will likely have to take steps to update and close any loopholes so future incidents can be prevented, he said. But prevention will depend on how big of a cyber threat the organization is dealing with, Essex added.

Williams said the health unit has a "series of robust tools" that monitor, detect and investigate potential threats but due to the rapidly evolving nature of cyber threats, security incidents can't always be prevented.

"As the investigation unfolds, we will continue working with our third-party cyber security experts to understand exactly how the incident occurred and ways in which we can build on any lessons learned," she said.