Ontario’s birth registry says MOVEit Transfer hack impacted over 3.4m residents

Ontario’s birth registry, better known as BORN Ontario, recently suffered a significant data breach as a result of the Clop ransomware group exploiting a zero-day vulnerability in the MOVEit Transfer web application.

The Better Outcomes Registry & Network (BORN) is a government-funded healthcare organisation and prescribed perinatal, newborn and child registry with the role of facilitating quality care for families across the province.

In a recent notice published on its website, BORN Ontario said that it used Progress Software’s MOVEit Transfer web application to send and receive files securely and was impacted after cyber criminals exploited a zero-day vulnerability in the application to access its users’ data.

The registry said the compromised personal health information that was exfiltrated from its internal server included information about fertility, pregnancy, newborn and child healthcare offered by several healthcare facilities based in Ontario between January 2010 and May 2023.

“After becoming aware of the incident on May 31, 2023, BORN posted a public notice on our website about the incident and notified relevant authorities, including the Ontario Provincial Police and the Information and Privacy Commissioner (IPC) of Ontario,” the notice reads.

An in-depth analysis of the incident has revealed that the incident compromised the personal health information of approximately 3.4 individuals, primarily those who sought pregnancy care and newborns who were born in Ontario between January 2010 and May 2023.

“Data privacy is paramount to everything we do at BORN. We began working with cybersecurity experts immediately to isolate the affected computer server, contain the threat, investigate the full scope of the incident, and to ensure our systems were safe to continue our operations.

“While attacks on third-party software are difficult to prevent, we’ve taken additional measures to further strengthen our security controls to limit the potential for this type of incident happening again,” BORN added.

The registry said it found no evidence of the compromised information being misused, but continues to monitor the internet, including the dark web, for any activity related to this incident. So far, it has found no sign of the stolen data being posted or offered for sale.  

The incident has reportedly impacted several major paediatric healthcare providers, including the Hospital for Sick Children, commonly known as SickKids. In a notice posted on its website, SickKids said that it is one of the hospitals affected by the security incident at BORN Ontario.

“We are among the many Ontario healthcare providers that share personal health information with BORN Ontario related to pregnancy, birth and newborn care – important healthcare encounters that can affect lifelong health.

“BORN collects data from healthcare providers pursuant to the authority afforded to it in the Personal Health Information Protection Act (PHIPA). BORN Ontario uses this information to identify immediate care gaps affecting individuals, link information to appropriate care providers, perform health system quality assurance, and analyse data for emerging trends,” SickKids said in its data breach notice.