Tilbury District Family Health Team patient data taken in TransForm ransomware attack

The Tilbury District Family Health Team, a primary care clinic in southwestern Ontario, told patients in January 2024 that their personal health information had been taken in the ransomware attack on TransForm Shared Service Organization, the technology provider that ran servers for the clinic and five area hospitals.

The attack was detected on October 23, 2023. TDFHT said its electronic medical record system was not accessed or taken, but data held on a shared drive was. That drive held database reports covering patients seen from 2015 onward.

The information involved included names, dates of birth, addresses and, for a limited number of people, health card numbers. Clinical details were also affected, among them reports on medical status for conditions such as COPD, congestive heart failure, diabetes and cancer, smoking status, medication summaries including opioid prescribing, immunization records and therapy status summaries. The clinic said no social insurance numbers and no credit card, banking or other financial information were taken.

TDFHT said it had no evidence the information had been misused. It notified affected patients by letter, reported the breach to Ontario's Information and Privacy Commissioner, and advised patients to monitor their accounts, change passwords and treat unsolicited contact with caution. The same TransForm attack also exposed patient and staff data at Bluewater Health, the Chatham-Kent Health Alliance, Erie Shores HealthCare, Hotel-Dieu Grace Healthcare and Windsor Regional Hospital.