City of Spruce Grove exposed in Homewood Health hack

0
155

Article content

The City of Spruce Grove was victimized in a recent cyberattack and massive data breach that hit national health-care provider Homewood Health and led to the personal data of some Albertans being put up for auction online.

Article content

The city told Postmedia on Thursday the provider indicated it was not compromised in the breach, but Homewood Health changed its tune Friday morning.

“We were informed late this morning by Homewood Health that we were one of the clients impacted,” city spokesperson Jennifer Hetherington said in an email Friday afternoon.

Homewood said no personal information was taken.

“They advised us that based on their investigation that the information related to the City of Spruce Grove that was accessed through the breach was not personal information but information general in nature to the City of Spruce Grove,” Hetherington said.

The City of Spruce Grove uses Homewood’s employee and family assistance program which offers counselling for mental health and addictions. Hackers accessed the same program used by Workers’ Compensation Board of Alberta employees and published sensitive data including full names, locations, marital status, and the reason for counselling.

Article content

Homewood said Thursday it didn’t know the full scope of the breach, nor had it been able to figure out how it happened.

But Postmedia saw documents referencing the City of Spruce Grove in a sample posted for sale on hacker group Marketo’s website earlier this week, which has since been removed. The proof package was meant to give potential buyers a taste of the 180 gigabytes of information the hackers claimed to have.

Brett Callow, threat analyst for cybersecurity company Emsisoft, told Postmedia Thursday that the sample — only about 100 megabytes in size — was just a small look at the kind of information hackers claimed to have in their possession.

Asked if he was worried more information beyond what was in the sample may be exposed, Spruce Grove Mayor Stuart Houston said he doesn’t want to see data breaches but as far as he knows the impact on the city was minor.

“These things do happen, and unfortunately with cybersecurity, these types of breaches are certainly concerning to anybody, but I feel confident in saying the breach didn’t affect any employees or personal information within the City of Spruce Grove.”

Read more about the cyber attack’s impact on Alberta here.

lboothby@postmedia.com

@laurby