Cyberattack on B.C. health recruitment sites exposed up to 240,000 records

The Health Employers Association of British Columbia said in early August 2023 that a cyberattack on three of the websites it operates may have exposed personal information belonging to health care workers and applicants.

The affected sites were Health Match BC, which recruits physicians, nurses and other health professionals, Locums for Rural BC, and the BC Care Aide and Community Health Worker Registry.

The association said an intruder had access to the server between May 9 and June 10, 2023, and that the activity was found on July 13 through ongoing monitoring. Roughly 240,000 email addresses were stored on the compromised server, though the association said it could not yet establish how many people actually had data taken.

Chief executive Michael McMillan said the information at risk could include email addresses, dates of birth, Social Insurance numbers, passport and driver's licence details, educational credentials and, in some cases, investigative reports. The association said no health records were held on the affected server.

The data was moved to a secure server and temporary websites were stood up so the recruitment programs could keep operating. The association notified British Columbia's information and privacy commissioner, the Canadian Centre for Cyber Security and police, engaged third party cybersecurity experts, and offered two years of Equifax credit monitoring to affected people.