Ransomware Hits Manitoba’s Largest Hospital, Disrupts HVAC and Access Control
Ransomware attackers disrupted the engineering systems of Manitoba’s largest hospital, in the Canadian province. Following a cyberattack at the Health Sciences Centre in Winnipeg, problems emerged in the centralized control of ventilation, air conditioning, and electronic access badges, though patients continued receiving treatment as normal throughout the incident.
Malicious Activity Detected August 10
Shared Health reported that the malicious activity was first detected on August 10. Staff immediately isolated the affected network to halt any further unauthorized access. The hospital activated its cyber incident response plan, assembled a task force, and brought in information security specialists and legal counsel. Law enforcement authorities were also notified of the incident.
Centralized HVAC Control Knocked Offline
The attack affected systems serving buildings across both the Health Sciences Centre and CancerCare Manitoba. Specifically, centralized control over heating, ventilation, and air conditioning stopped functioning. The physical equipment itself continued operating, with staff shifting to local, manual control instead. Air continued circulating normally throughout the buildings, and the air conditioning units were never shut down.
Access Control System Faces a More Complex Recovery
The situation surrounding the access control system proved more complicated. Health Sciences Centre’s security team is temporarily unable to issue new electronic access badges or modify permissions on badges already issued, since the system responsible for that functionality was among those affected by the attack. Existing badges, however, continue to function normally. Hospital administration has increased on-site physical security presence, and security personnel continue actively monitoring the buildings.
Clinical Systems and Patient Care Unaffected
According to Shared Health, clinical systems and medical care were not impacted by the attack. Patients were not asked to reschedule hospital visits, and medical services continued operating without interruption. This indicates that the affected infrastructure was successfully segregated from the systems used directly in patient treatment.
Investigation Into Potential Employee Data Access Ongoing
Separately, Shared Health is investigating whether attackers gained access to employee data. Specialists have not yet determined whether the attackers viewed or exfiltrated any information. A preliminary review found no indications of access to financial records or patient medical data.
Investigation Continues
The investigation into the incident remains ongoing. Shared Health has not yet disclosed how attackers infiltrated the network, the name of the ransomware strain involved, the identity of the attackers, or any potential ransom demand. Should the investigation confirm that employee information was compromised, the organization has committed to notifying affected individuals and communicating the appropriate next steps.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
