Unknown number of British Columbians' personal information for sale online after health company extorted
CTV News has learned the personal information of British Columbians has been leaked online, with an unknown number of people and agencies potentially still vulnerable, after a data breach at a mental health services provider.
Homewood Health, headquartered in Ontario with services and contracts across Canada, acknowledges it was hacked earlier this year and has recently begun contacting affected companies and agencies whose information may be compromised, including BC Housing, TransLink and the Provincial Health Services Authority.
CTV News has confirmed at least some of the information leaked online is authentic, though the bulk of the data is still on the auction block at Marketo, a site that describes itself as a "leaked data marketplace."
There appear to be hundreds of bids from prospective buyers.
“With the assistance of cybersecurity experts, we have been working diligently to understand how the information was obtained and what information has been affected,” wrote a Homewood Health spokesperson, blaming the breach on state-sponsored Chinese hackers, called Hafnium, who victimized thousands of companies earlier this year. “To date, neither Homewood Health nor its third-party cybersecurity experts have been able to find any evidence of any unauthorized access to any of Homewood Health’s client application systems.”
The company would not estimate how many people’s information could be compromised, insisting while they were notifying affected individuals as quickly as possible, “this process will take time.” They provide services ranging from career and family counselling, to mental health and addiction support and operate retreats for extended stays.
B.C. AGENCIES NOTIFIED OF DATA BREACH
BC Housing appears to be the agency most impacted thus far.
Personal information of hundreds of employees has already been leaked online as a “teaser” or sample of the kind of material the hackers possess, which the provide to try and verify the authenticity and value of the rest of the data package.
“We are very concerned that Homewood Health documents containing the personal information of our employees, and potentially their family members, have been compromised in a data incident,” wrote a spokesperson. “It is Homewood Health that was breached, and they must take steps to protect all those involved.”
The agency, which is focused on providing and running affordable and supportive housing, goes on to say that it's still waiting for critical information from Homewood Health, including how many people and how much information could be involved – and what kind of supports it will be providing for impacted employees.
The sample package also includes a contract between Homewood and TransLink, plus a document updating a previous agreement with BC Clinical Support Services, which is overseen by PHSA.
“We have been in communication with Homewood Health and they have assured us that there was no PHSA employee/patient information included in the breach they are managing,” wrote a spokesperson. “This contains purely contractual information and does not contain any personal information.”
TransLink said it was aware of the information for sale.
“This agreement does not contain any personal information of employees of TransLink or any of its subsidiaries,” it said in an email. “We have since been in contact with Homewood Health, and given that this is their active investigation, we will direct all questions to them."
A Homewood Health representative said the hackers had tried to extort the company over the information, characterizing it as a “dark web” scheme, but the Marketo website can be accessed by anyone with an internet connection.
“This isn't only on the dark web, Marketo group's site exists on the clear web too, so it's very easily accessed," explained online threat analyst Brett Callow, who works for Emsisoft on Vancouver Island. “These types of incidents are extremely common and there are about 2,500 organizations that have had their data stolen and published on sites like this -- and that just within the last couple of years."
THE HACKERS SPEAK UP
Marketo, which has the same name as an online marketing company by Adobe but bears no connection, calls itself a “leaked data marketplace” but it’s perhaps more accurate to describe it as an online clearinghouse for stolen information. The first and most prominent listing currently on its website is for Homewood Health, and it shows that 289 bids have purportedly been made for the information so far.
When CTV News contacted the site, a representative countered Homewood’s description of events, insisting they researched the weaknesses of Homewood Health and other companies and attacked them directly, insisting they did not acquire the data as part of the Hafnium hack.
“I got to say it right away that we just sell company data. We do not have the intention to harm customers or clients of this company,” wrote a spokesperson identifying themselves as Mannus Gott. “If the company understands and is willing to accept responsibility for the leak, there will be no publication. Otherwise, we are not responsible for the safety of this data.”
They say on Thursday, some of the data will be sold and the rest will be published.
Homewood says it has contacted police and has hired its own investigators and experts to advise them.
While extortion and blackmail of companies facing data breaches has become more and more common, it can be shocking and stressful for individuals caught up in the scheme.
"They should be reasonably concerned,” said Callow, suggesting they contact their banks to warn them if notified by Homewood. “The data that's out there could potentially be used for data theft and given the type of information Homewood may own, it could potentially be used to blackmail individuals as well, or attempt to."
Callow pointed out companies that’ve been breached will typically pay for customers to have monitoring in place after such a breach, adding this should be a reminder for individuals, companies and other organizations to take the utmost care in safeguarding their information, including using patches, updates and opting for multi-factor authentication whenever available.
Vancouver Top Stories
CTVNews.ca Top Stories
After the most expensive election in Canadian history resulted in little change politically, many are asking whether it was worth the $610-million price tag and where else that money could have been spent.
Inside hospitals across Saskatchewan, which has one of the lowest vaccination rates in the country, health-care workers are reporting a worsening crisis, with record-breaking COVID-19 hospitalizations pushing the health-care system to the brink.
Long-term care outbreaks are rising, and provinces have different strategies for keeping COVID-19 out
As the fourth wave continues across Canada and community spread climbs, outbreaks are also on the rise inside Canada’s long-term care homes, leading experts to stress the importance of staff being vaccinated — an issue which varies province to province.
The boyfriend of Gabby Petito, whose body was found at a national park in Wyoming after a cross-country trip with him, was charged with unauthorized use of a debit card as searchers continued looking for him Thursday in Florida swampland.
British actor Tom Felton, known for his portrayal of Draco Malfoy in the 'Harry Potter' movies, collapsed while playing a celebrity golf exhibition Thursday at the Ryder Cup.
Canadian fashion model Linda Evangelista says she's been left 'permanently deformed' from a cosmetic procedure that she had approximately five years ago.
The corporate entities of SNC-Lavalin Inc. and SNC-Lavalin International Inc., as well as two former senior executives of the Quebec-based firms have been charged with a series of fraud and forgery offences by the RCMP.
Canada saw only a slight increase in the volume of foreign nationals entering the country in the first week after the border opened to those who are fully vaccinated against COVID-19.
An Ontario mother, who had been holding a one-woman protest for the past week to try to get help with her son's autism care, will finally have her file looked at after a call from the social services minister.
The cases were among 832 new cases found in B.C. over the past 24 hours, according to the Ministry of Health.
The president of the Cedar Hill Golf Club says a report from District of Saanich staff recommending changes to the operation df Cedar Hill Golf Course will hurt the club and its members.
Health officials on Vancouver Island have declared clusters of COVID-19 at four more schools in the South Island. There are now five active clusters at schools in the region.
Alberta reported 1,660 new cases of COVID-19 and 17 new deaths on Thursday.
Alberta Health is investigating whether an Edson party advertising itself as a “get COVID” event to build up natural immunity to the virus actually happened.
Some Calgary businesses say while the new city vaccination bylaw doesn't change what they do, it does ease some of the pressure on front line staff.
Alberta reported 1,660 new cases of COVID-19 and 17 new deaths on Thursday.
Two men were rushed to hospital after an apparent drive-by shooting in south Edmonton Thursday night.
While five front-running mayoral candidates faced off in a forum Thursday afternoon, the other candidate, Mike Nickel, was serving hot dogs in the parking lot of his campaign office.
An Ontario man who had a faulty gas metre and racked up at $1,000 bill says was shocked when the was told he would still have to pay the bill.
Someone in Ontario won more than $21 million in Wednesday’s LOTTO 6/49 draw but has yet to check their ticket.
Unvaccinated MPPs could be prevented from entering Queen’s Park when the legislature resumes in October unless they get tested for COVID-19.
After just a few hours of debate, Quebec's National Assembly voted unanimously Thursday evening to pass a new bill that would prohibit anti-vaccine protesters from demonstrating near schools, daycares, and hospitals -- an offence punishable by a fine of up to $12,000.
Quebec kids were at the heart of a heated exchange Thursday over language laws -- specifically, English-speaking kids and whether they're really leaving school with functional French.
Amid major staff shortages, Quebec will cut large cheques to health-care workers in a bid to strengthen a public network put under serious pressure by the pandemic.
A Manitoba critical care doctor and infectious diseases specialist remains cautiously optimistic when it comes to the impact of the fourth wave in Manitoba.
A multi-car crash on a Manitoba highway on Wednesday resulted in police arresting a driver on impaired driving and weapon charges.
Five businesses in Manitoba received tickets last week for not following public health orders.
Saskatchewan broke COVID-19 hospitalization records again on Thursday, reporting 273 patients in hospital with 58 in intensive care.
Saskatoon City Council will look at a committee recommendation to allow parking patios to operate through the winter, making them a year-round amenity.
A Saskatoon judge has ruled in favor allowing a father to have his child vaccinated despite the mother being opposed to her child getting the shot.
'Unbelievably heartbreaking': Sask. nurse left waiting for transplant as province suspends organ donation program
Krystal Graham has been on the liver transplant waitlist for about a year. Now, she says she is concerned COVID-19 will delay her life-saving surgery even longer.
The Melville Millionaires have postponed hockey games until further notice after a positive COVID-19 case associated with the team.
Six-year-old Nygah Eashappie is pretty subdued about his newfound fame. The Regina boy is the latest to model in advertisements for local clothing brand; 22Fresh.
The first twenty-four hours following New Brunswick's rollout of new pandemic restrictions have been rocky for some of the businesses tasked with enforcing the new rules.
Health officials in Nova Scotia are reporting the province’s 95th death related to COVID-19, along with 41 new cases and 20 recoveries on Thursday, as the number of active cases in the province rises to 147.
Health officials in New Brunswick are reporting 52 new cases of COVID-19 on Thursday, along with 35 recoveries, as the number of active cases in the province rises to 574.
Between flooded roads and flooded basements, London and surrounding regions were left drenched after a significant rain event rolled through the area.
The province has been alerted to a significant rise in COVID-19 cases detected among children in London and Middlesex County.
About 3,500 people tucked away their pandemic blues and hit the mud-soaked Delaware Speedway for Road to Rock the Park Thursday night.
An investigation into the shooting of a white cow moose in northern Ontario last fall has been closed and officials say no charges will be laid.
A 17-year-old from Greater Sudbury has been charged with attempted murder in connection with the stabbing of a woman downtown last week.
CTV News has learned Timmins police have a suspect in custody after one person was killed and two others were injured in a shooting in Schumacher overnight.
A former Kitchener MP has pleaded guilty to assault charges.
Although many businesses in Waterloo Region say the vaccine certificate program has been running smoothly so far, they're prepared for that to change.
Former Nazi death-squad member Helmut Oberlander has died in the midst of his Canadian deportation hearing.