Ransomware at TransForm knocked out systems at six Ontario health facilities

TransForm Shared Service Organization, the not-for-profit body that runs information technology, supply chain and accounts payable services for hospitals in southwestern Ontario, was hit by ransomware on October 23, 2023. The attack took down systems at Windsor Regional Hospital, Hotel-Dieu Grace Healthcare, Erie Shores HealthCare in Leamington, Chatham-Kent Health Alliance, Bluewater Health in Sarnia and the Hospice of Windsor and Essex County.

Patient records and email went offline and staff reverted to paper charting. The hospitals rescheduled and postponed appointments and surgeries, redirected non-urgent cases elsewhere, and sent some radiation therapy patients out of the region for treatment. Windsor Regional Hospital processed payroll manually and warned thousands of staff that errors were possible.

Early in the response TransForm said it was still investigating the cause and scope of the incident, including whether any patient information was affected. In early November the Daixin Team extortion group claimed the attack and began publishing files after the hospitals declined to pay, saying it held database records covering 5.6 million patient visits along with roughly 160 GB of scanned internal documents.

Windsor Regional Hospital president David Musyj said the hospitals would not pay because they could not trust a criminal group's promise to delete stolen information, and that bringing clinical applications back one at a time safely would take weeks rather than days.