Glossary term
Ransomware
Ransomware is malware that encrypts files and systems so they become unusable until a ransom is paid.
Read more
Significant cyber incident
Newfoundland and Labrador health system ransomware attack (2021)
In October 2021 the Hive ransomware group attacked the health information systems of Newfoundland and Labrador, Canada.
In short
In October 2021 the Hive ransomware group attacked the health information systems of Newfoundland and Labrador, Canada. The attacker used a stolen VPN login, moved through the network for two weeks, took more than 200 gigabytes of data and then locked many systems. Appointments and treatments were canceled and records were kept on paper. The provincial privacy commissioner found that basic security measures were missing.
What happened
On Saturday 30 October 2021 the Government of Newfoundland and Labrador said an IT systems outage was affecting health-related online services. It later became clear that this was a cyberattack on the Newfoundland and Labrador Centre for Health Information (NLCHI) and the regional health authorities whose IT it managed. The province’s own investigation found it was a ransomware attack involving Hive ransomware.
The attacker had been inside the network since 15 October 2021. It entered through a VPN connection that used the compromised credentials of a legitimate user account. How those credentials were compromised was never determined. The attacker moved through the network, raised its privileges through an administrative account, and took data between 26 and 29 October. On 30 October it deployed Hive ransomware and encrypted many systems. That outage is what exposed the attack.
In the following days health care ran on paper. Central Health canceled all booked appointments for 1 November and chemotherapy appointments at three Western Health sites did not go ahead that day. On 9 and 10 November the province confirmed that personal information and personal health information had been accessed. The stolen data covered patients and current and former employees of several regional health authorities.
The province published an overview of the attack in March 2023, and the Commissioner’s report names 14 March 2023 as the release date. The Information and Privacy Commissioner of Newfoundland and Labrador published an independent report on 23 May 2023. That report is the main source for what went wrong and is used throughout this page.
Timeline
-
15 October 2021
The earliest attacker activity found: a VPN connection to the health information center's environment using the compromised credentials of a legitimate user account.
-
25 October 2021
The attacker moves laterally and escalates privileges through an account with administrative privileges.
-
26 to 29 October 2021
The attacker takes data, including personal information and personal health information.
-
30 October 2021
The attacker deploys Hive ransomware and encrypts many systems. The Department of Health and Community Services advises of an IT systems outage.
-
31 October 2021
The center notifies the Canadian Centre for Cyber Security, the Royal Newfoundland Constabulary and the RCMP. The province says all booked Central Health appointments for 1 November are canceled.
-
1 November 2021
The center notifies the provincial privacy commissioner. A public announcement about the outage is made.
-
3 November 2021
A public announcement of an attack is made.
-
9 November 2021
The province says personal information and personal health information was accessed, and an initial announcement of a privacy breach is made.
-
10 November 2021
The province says personal health information in the Central Health region was also accessed.
-
5 December 2021
Most critical and priority systems have been restored or rebuilt from backups.
-
26 January 2023
The US Department of Justice announces disruption of the Hive ransomware group.
-
14 March 2023
The Government of Newfoundland and Labrador releases its overview of the attack.
-
23 May 2023
The Information and Privacy Commissioner of Newfoundland and Labrador issues its investigation report.
How the attack worked
The two official accounts agree on the steps. The Commissioner’s office says it cannot publish further technical detail for security reasons, so this page stays at the level the reports give.
Getting in
On 15 October 2021 the attacker made a VPN connection using the compromised credentials of a legitimate user account (Valid Accounts, T1078; External Remote Services, T1133). The investigation could not find out how the credentials were compromised. The Commissioner’s office concluded that initial access was likely gained through email phishing, but says no definitive evidence exists. The CISA advisory on Hive says Hive actors gain access to victim networks by using single factor logins over RDP, VPN and other remote connection protocols.
Moving and taking data
On 25 October the attacker moved laterally and raised its privileges through an account with administrative privileges. Between 26 and 29 October it took more than 200 gigabytes of data, including patient and employee records. Some attacker activity also took place in the environment of a managed service provider to the center. Many of the tools and techniques used were common and well known, and the Commissioner’s delegate found that some activity had triggered alerts before 30 October that were not properly investigated.
Locking the systems
In the early hours of 30 October the attacker deployed Hive ransomware and encrypted many systems (Data Encrypted for Impact, T1486). Hive is run as ransomware-as-a-service. Developers build the malware and affiliates carry out the attacks. The attacker was in the network for about two weeks before the encryption exposed it.
- Log in over VPNOn 15 October 2021 the attacker used the compromised login of a real user accountTechnique T1133 (MITRE ATT&CK, opens in a new tab)
- Spread and gain admin rightsOn 25 October the attacker moved through the network and used an administrative account
- Take dataBetween 26 and 29 October more than 200 gigabytes of data were taken
- Deploy Hive ransomwareOn 30 October many systems were encrypted, which caused the outage and exposed the attackTechnique T1486 (MITRE ATT&CK, opens in a new tab)
ATT&CK techniques
- Technique Data Encrypted for Impact Data Encrypted for Impact is when attackers encrypt files or whole systems so the owner can no longer use them, and then hold back the key. T1486 · Impact
- Technique External Remote Services External Remote Services is a technique where an attacker uses a remote access service that faces the internet, such as a VPN or Citrix, to enter a network or to keep access to it. T1133 · Persistence, Initial Access
- Technique Valid Accounts Valid Accounts means an attacker logs in with real credentials that were stolen or bought. T1078 · Stealth, Persistence, Privilege Escalation, Initial Access
Who says who was behind it
Who attributed it, and how firm it is
The province's investigation determined the ransomware was Hive. The Government of Newfoundland and Labrador said in March 2023 that there is no evidence the attack was intended to target the province's health system specifically. The Commissioner's report says the RCMP investigated and that no criminal charges were laid. The US Department of Justice announced disruption of the Hive group on 26 January 2023. No state attribution has been made in the sources opened.
Impact
The Commissioner called it by far the largest attack of its kind ever experienced in the province, and one of the largest in Canadian history to date by the number of people whose information was stolen. It was judged likely that the vast majority of the population had some personal or personal health information taken.
Taken data included patient registration data, medical information for some patients, and employee names, addresses and Social Insurance Numbers. The province said Social Insurance Numbers of 2,514 patients were taken. Patients of Eastern Health (2010 to 2021), Central Health (2006 to 2021) and Labrador-Grenfell Health (2013 to 2021) were affected, as were all patients whose blood work was sent to Eastern Health for specialized testing, and all patients with COVID-19 testing in the province up to 2021.
Care was disrupted. Central Health canceled booked appointments for 1 November 2021, chemotherapy appointments at three Western Health sites did not proceed that day, regional email was down, and staff kept paper records that later had to be entered into systems. Most critical systems were back by 5 December 2021, and other systems followed over the weeks after.
The Commissioner said the stolen data can never be fully recovered or contained. In March 2023 the province said there was no evidence the data had been misused.
Government and regulator response
- 30 to 31 October 2021: the center started its emergency operations, notified the Cyber Centre, the Royal Newfoundland Constabulary and the RCMP, and engaged external cyber security experts. Early notices from the Department of Health and Community Services told people which services were affected.
- 1 to 10 November 2021: the provincial privacy commissioner was notified, public announcements were made on 1, 3, 9 and 10 November, and a provincial call center was opened.
- Containment: workstations and servers were taken offline as needed, passwords were reset on multiple occasions, gateway components were patched, an endpoint detection and response tool was deployed, mandatory multifactor authentication was introduced for remote connections, and 24/7 monitoring was put in place.
- Support for affected people: credit monitoring and identity theft protection were offered, for five years to those whose Social Insurance Number or banking information was taken, and for current and former employees, physicians and locums.
- Longer term: the health bodies created a program called Breakwater to counter cyber threats and build resilience.
- 23 May 2023: the Information and Privacy Commissioner issued 34 findings and six recommendations. It found the breach response was by and large carried out well, but that details such as the ransomware nature and the Hive name were not given to the public at the first reasonable opportunity. It recommended periodic external reviews of cyber security across the provincial health information system.
Lessons
-
A stolen login can be enough
The attacker got in with the compromised credentials of a legitimate user account, and the source of the credentials was never found. Strong authentication on every remote connection matters more than hoping the password stays secret.
-
Alerts must be answered
The Commissioner's delegate found that some attacker activity triggered alerts before the attack and that these were not properly investigated. An alert nobody follows up is the same as no alert.
-
Known weaknesses must be fixed
The Commissioner found the vulnerabilities were known inside the health system, but sufficient and timely steps were not taken. A risk list is only useful if the items on it get done.
-
Two weeks is a long time
The attacker spent about two weeks in the network and took more than 200 gigabytes before the encryption exposed it. Detection that waits for the ransom note is too late.
-
Tell the public what happened
The Commissioner found that the public was not told it was a ransomware attack by Hive at the first reasonable opportunity. People need that detail to decide how to protect themselves.
-
Shared IT means shared risk
One center ran IT for several regional authorities, with a managed service provider involved. A weakness in the shared layer reached the whole province.
What to check in your own organization
-
Remote access login
List every VPN and remote access route. Confirm multifactor authentication applies to every user, including administrators and service accounts.
-
Credential theft
Check how you would learn that a staff login is being sold or has been phished, and how fast you could reset it.
-
Alert follow-up
Review a sample of high-priority alerts from the last quarter. Check that each one has a named owner and a recorded outcome.
-
Administrative accounts
List accounts with administrative rights. Alert when one is used from a new place or at a new time, or to reach many systems quickly.
-
Large data movement
Check whether you would notice hundreds of gigabytes leaving the network over several days.
-
Backups and rebuild
Test restoring core clinical or business systems from backups, and write down the order in which systems come back.
-
Paper fallback
For critical services, write down and rehearse how work continues on paper, including how the backlog is entered later.
-
Public notice plan
Decide in advance who tells the public what, and when, including naming the ransomware type if known.
Where it happened
- Country Canada Canada faces state espionage, ransomware against hospitals, governments and critical infrastructure, and pro-Russia denial of service campaigns. North America
- Industry Healthcare and pharma Ransomware, stolen staff logins, patient data on leak sites and supplier exposure at hospitals and drug makers, and the rules that apply.
Questions
What happened in Newfoundland and Labrador in October 2021?
A ransomware attack on the province's health information systems. The government said it involved Hive ransomware and that personal information and personal health information were taken.
How did the attacker get in?
By a VPN connection using the compromised credentials of a legitimate user account on 15 October 2021. The investigation could not find out how the credentials were compromised. The Commissioner's office judged email phishing likely but without definitive evidence.
How much data was taken?
The Commissioner's office says more than 200 gigabytes. It judged that the vast majority of the province's population likely had some personal or personal health information taken, though the exact number may never be known.
Was a ransom paid or the data published?
The sources opened for this page do not say. The government said in March 2023 that there was no evidence the stolen information had been misused.
Who was behind it?
The government said the ransomware was Hive. The Hive group's infrastructure was disrupted by the US Department of Justice on 26 January 2023. The sources name no individuals, and the RCMP laid no criminal charges in this case.
What did the privacy commissioner find?
That the health bodies did not have reasonable security arrangements at the time, that a high impact ransomware attack was foreseeable, and that alerts before the attack were not properly investigated. It also found that later security work was reasonable, so it made only six recommendations.
Sources
- Report P-2023-001/PH-2023-002, investigation of the 2021 cyber attack Office of the Information and Privacy Commissioner of Newfoundland and Labrador
- Cyberattack on the Newfoundland and Labrador Health Care System, Overview (March 2023) Government of Newfoundland and Labrador, Department of Health and Community Services
- Public Advisory: IT Systems Outage Affecting a Number of Health-Related Services (30 October 2021) Government of Newfoundland and Labrador
- Public Advisory: Update on IT Outage Regarding Health-Related Services (31 October 2021) Government of Newfoundland and Labrador
- Public Advisory: Provincial Government Advises Data Impacted by Cyber Attack (9 November 2021) Government of Newfoundland and Labrador
- Public Advisory: Provincial Government Advises Data in the Central Health Region Impacted by Cyber Attack (10 November 2021) Government of Newfoundland and Labrador
- Valid Accounts, T1078 MITRE ATT&CK
- External Remote Services, T1133 MITRE ATT&CK
- Data Encrypted for Impact, T1486 MITRE ATT&CK
Browse the threat library
- APT groups State-backed hacking groups, who they go after and how they get in. 49 profiles
- Countries The sectors, groups and national bodies that matter in each country. 32 profiles
- Ransomware groups How each group gets in, how it extorts and what stops it. 24 profiles
- Malware and tools Malware families and abused tools, what they do and how to spot them. 46 profiles
- Techniques Attack techniques in plain words, mapped to MITRE ATT&CK. 36 profiles
- Vulnerabilities Flaws attackers use in real attacks and what to do about them. 44 profiles
- Significant Cyber Incidents Significant incidents since October 2024, with a dated timeline, sources and lessons. 103 profiles
Stay Ahead of
Digital Threats
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.