Skip to main content
The Globe and Mail
Support Quality Journalism.
The Globe and Mail
First Access to Latest
Investment News
Collection of curated
e-books and guides
Inform your decisions via
Globe Investor Tools
Just$1.99
per week
for first 24 weeks

Enjoy unlimited digital access
Enjoy Unlimited Digital Access
Get full access to globeandmail.com
Just $1.99 per week for the first 24 weeks
Just $1.99 per week for the first 24 weeks
var select={root:".js-sub-pencil",control:".js-sub-pencil-control",open:"o-sub-pencil--open",closed:"o-sub-pencil--closed"},dom={},allowExpand=!0;function pencilInit(o){var e=arguments.length>1&&void 0!==arguments[1]&&arguments[1];select.root=o,dom.root=document.querySelector(select.root),dom.root&&(dom.control=document.querySelector(select.control),dom.control.addEventListener("click",onToggleClicked),setPanelState(e),window.addEventListener("scroll",onWindowScroll),dom.root.removeAttribute("hidden"))}function isPanelOpen(){return dom.root.classList.contains(select.open)}function setPanelState(o){dom.root.classList[o?"add":"remove"](select.open),dom.root.classList[o?"remove":"add"](select.closed),dom.control.setAttribute("aria-expanded",o)}function onToggleClicked(){var l=!isPanelOpen();setPanelState(l)}function onWindowScroll(){window.requestAnimationFrame(function() {var l=isPanelOpen(),n=0===(document.body.scrollTop||document.documentElement.scrollTop);n||l||!allowExpand?n&&l&&(allowExpand=!0,setPanelState(!1)):(allowExpand=!1,setPanelState(!0))});}pencilInit(".js-sub-pencil",!1); // via darwin-bg var slideIndex = 0; carousel(); function carousel() { var i; var x = document.getElementsByClassName("subs_valueprop"); for (i = 0; i < x.length; i++) { x[i].style.display = "none"; } slideIndex++; if (slideIndex> x.length) { slideIndex = 1; } x[slideIndex - 1].style.display = "block"; setTimeout(carousel, 2500); } //

Front-line services were delayed and some appointments postponed after a cyberattack that forced the local health board that runs Montreal’s Jewish General Hospital to disconnect its servers from the internet.

The breach occurred Wednesday, just as U.S. authorities and cybersecurity firms warned that criminals are deliberately targeting hospitals with ransomware – malicious computer codes that shut down institutional servers to extort a payment.

The Montreal incident affected a local health board known by its French name, CIUSS Centre-Ouest. It manages the Sir Mortimer B. Davis Jewish General Hospital but also the smaller Mount-Sinai Hospital, six nursing homes and five community clinics.

Story continues below advertisement

The CIUSS’s associate chief executive, Francine Dupuis, said the cyber intrusion was spotted early so no data was accessed or locked away, and no ransom demand was made.

Officials did not explicitly make a connection with the American ransomware alert but said the incident was not isolated. “It’s not just in Quebec, it might be broader than that, this breach,” Quebec Health Minister Christian Dubé told reporters Thursday.

“The Cyber Centre is aware of a recent ransomware campaign targeting Canadian health organizations,” said Evan Koronewski, a spokesman for the Communications Security Establishment.

The CSE is an intelligence agency that runs a subunit known as the Canadian Centre for Cyber Security. The centre issues public warnings about a variety of hacking threats.

FireEye, the parent company of the American cybersecurity firm Mandiant, says that an Eastern European hacking group known as UNC1878 launched the attacks against hospitals, using the Ryuk ransomware.

“We’ve seen Canada-based organizations impacted by UNC1878′s ransomware operations,” FireEye spokeswoman Sarah Coutermarsh told the Globe and Mail.

“UNC1878 is one of most brazen, heartless, and disruptive threat actors I’ve observed over my career,” FireEye chief technical officer Charles Carmakal said in a statement.

Story continues below advertisement

A joint U.S. government task force that includes the FBI issued an alert Wednesday warning of an imminent cybercrime threat to health care providers. “These issues will be particularly challenging for organizations within the COVID-19 pandemic,” the alert said.

Lawrence Rosenberg, the chief executive of CIUSSS Centre-Ouest, said the hacking attempt in Montreal forced facilities to shut down telephone switchboards and cut off internet and remote access to the computer network.

Test results had to be sent out by text messaging. Fortunately, Dr. Rosenberg said, the CIUSSS’s operations weren’t fully electronic yet. “There still was paper being used. We’re just going to fall back and use more paper than we would.”

Staff were instructed for the next three days to print or save on an encrypted memory key any documents they are creating. “I realize that this task is likely to be time-consuming. However, this pro-active precautionary measure is essential,” Dr. Rosenberg said in a memo to staff send Wednesday.

Dr. Rosenberg told reporters that if there had been a ransom demand, it would have been up to the province to decide whether to pay.

The U.S. task force alert warned that “payment does not guarantee files will be recovered. It may also embolden adversaries to target additional organizations.”

Story continues below advertisement

The Ryuk ransomware is behind the majority of cyber-extortion payments in recent years, according to the FBI.

Speaking at the RSA IT security conference earlier this year, Joel DeCapua, an FBI special agent, said his agency has tracked US$144-million in ransoms paid between 2013 and 2019. Of that tally, more than US$61-million was extorted through Ryuk.

Our Morning Update and Evening Update newsletters are written by Globe editors, giving you a concise summary of the day’s most important headlines. Sign up today.

Your Globe

Build your personal news feed

  1. Follow topics and authors relevant to your reading interests.
  2. Check your Following feed daily, and never miss an article. Access your Following feed from your account menu at the top right corner of every page.

Follow the authors of this article:

Follow topics related to this article:

View more suggestions in Following Read more about following topics and authors
Report an error Editorial code of conduct
Due to technical reasons, we have temporarily removed commenting from our articles. We hope to have this fixed soon. Thank you for your patience. If you are looking to give feedback on our new site, please send it along to feedback@globeandmail.com. If you want to write a letter to the editor, please forward to letters@globeandmail.com.

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff. Non-subscribers can read and sort comments but will not be able to engage with them in any way. Click here to subscribe.

If you would like to write a letter to the editor, please forward it to letters@globeandmail.com. Readers can also interact with The Globe on Facebook and Twitter .

Welcome to The Globe and Mail’s comment community. This is a space where subscribers can engage with each other and Globe staff.

We aim to create a safe and valuable space for discussion and debate. That means:

  • Treat others as you wish to be treated
  • Criticize ideas, not people
  • Stay on topic
  • Avoid the use of toxic and offensive language
  • Flag bad behaviour

Comments that violate our community guidelines will be removed.

Read our community guidelines here

Discussion loading ...

To view this site properly, enable cookies in your browser. Read our privacy policy to learn more.
How to enable cookies