Hackers have infiltrated four Innomar health clinics in Saskatchewan, stealing the sensitive information of 7,293 patients. This breach, identified earlier this year, involved the theft of electronic patient records, as Saskatchewan’s Information and Privacy Commissioner (IPC) Ronald Kruzeniski confirmed. These private clinics, located in Regina, Saskatoon, North Battleford, and Prince Albert, specialize in lab testing and blood work. Notably, Innomar’s pharmacies remained unaffected.

Timeline and Key Details

The breach occurred in two stages, demonstrating the vulnerabilities within network systems.

Initially, in January 2024, hackers accessed a server belonging to one of Cencora’s affiliates, exploiting weak network segmentation to infiltrate Innomar’s systems.
Subsequently, by February 21, 2024, Innomar detected unauthorized access. By April 10, 2024, it was confirmed that patient data had been stolen.

What Information Was Stolen?

Hackers extracted a comprehensive range of sensitive data, which included:

Personal details such as names, addresses, and dates of birth.
Medical information including diagnoses, prescriptions, and lab results.
Contact details like phone numbers and email addresses.
Health insurance numbers and unique patient identification details.

Although Innomar reported the breach to the IPC on May 9, 2024, patients only received notification letters on May 31, 2024, leading to concerns about delayed communication.

Recommendations and Findings by the IPC

The IPC investigation acknowledged that Innomar Strategies Inc. and its parent company, Cencora, took significant steps to contain the breach. However, the delay in notifying affected individuals raised concerns about response time.

To ensure better future practices, the IPC has recommended:

Extending credit monitoring services from two years to a minimum of 10 years, as stolen data can resurface unexpectedly.
Strengthening network segmentation and security measures to prevent lateral movements by hackers.

Steps Taken by Innomar

Innomar has already implemented several measures aimed at improving its security infrastructure. For example, it enhanced its network segmentation to isolate critical systems, minimizing the risk of future breaches. Additionally, the company offered two years of credit monitoring to all affected individuals, providing a layer of financial protection against potential fraud.

How Patients Can Protect Themselves

If you are among those impacted, there are several precautions you can take to safeguard your personal information:

Enroll in the credit monitoring services offered by Innomar.
Regularly monitor your financial and health records for unusual activity.
Remain vigilant for phishing attempts or suspicious communications seeking more personal information.

A Critical Lesson for Healthcare Organizations

This breach serves as a stark reminder of the growing cybersecurity threats targeting healthcare providers. Therefore, organizations must prioritize real-time security monitoring, conduct regular audits, and provide comprehensive staff training. Taking proactive measures will mitigate risks and help maintain patient trust.

Conclusion

The Innomar health clinic breach underscores the need for organizations to enhance their security systems and respond promptly to incidents. While Innomar has taken steps to address the situation, ongoing vigilance will be critical to preventing similar incidents in the future.