The inside story of how N.L. health officials failed to act before a ransomware gang struck
CBC
Many numbers have been linked to the cyberattack on Newfoundland and Labrador's health-care system in the fall of 2021.
More than a half million people in the province, most of whom had their privacy breached.
More than 200,000 files on an Eastern Health network drive, accessed and taken.
More than 200 gigabytes of data exfiltrated, or stolen, by cyberthieves affiliated with the Hive ransomware gang.
But there is another number that perhaps best describes the lack of resources in the system before everything went wrong: three.
That's how many IT security staff there were for the entire provincial health system, according to a post-attack report by the Canadian Centre for Cyber Security.
The regional health authorities and the Newfoundland and Labrador Centre for Health Information were "severely understaffed from a technical resource perspective," the federal agency concluded.
That report was among the records reviewed by investigators in the office of Newfoundland and Labrador's privacy commissioner — records that would otherwise have largely remained off-limits to the public.
Investigators scanned through internal emails and unredacted government briefing materials that shed new light on what did — and, more importantly, didn't — happen in the lead-up to the devastating cyberattack in the fall of 2021.
In the wake of the ransomware strike, provincial government officials have largely skated around questions about whether the province's cyberdefences were as sturdy as the Rock of Gibraltar or as porous as the Maginot Line.
To a large degree, the provincial privacy watchdog's report answers those questions. And the answers are not reassuring.
It began, as many government initiatives do, with a consultant's report and a press release.
The consultant looked at eHealth services, and completed its report in early 2017. It recommended combining IT of the province's four regional health authorities and the Newfoundland and Labrador Centre for Health Information, or NLCHI.