Did CFPC inform docs about the cyber breach fast enough?

In April 2024, family physicians learned that the College of Family Physicians of Canada was the victim of a cybersecurity incident detected in October 2023.Why the long gap between the incident and informing the affected parties? According to a letter sent to physicians shared with the Medical Post, the CFPC “responded immediately and took steps to contain and isolate the threat and deployed countermeasures to prevent further unauthorized access to our network.” The CFPC also hired cybersecurity experts to figure out the scope of the breach. Those experts found that the hackers accessed and copied data from CFPC’s network, including names, addresses, dates of birth, email addresses, telephone numbers, medical licence numbers and payment receipts for membership dues from some members. No credit card data was stolen.The analysis of the breach took several months to complete and members were notified as soon as CFPC completed the review, it stated in an April 5 press release. The “relatively small group” who had banking information exposed received one year of credit monitoring from Equifax, a CFPC rep said.Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) outlines how organizations need to report privacy breaches in cases where it creates “a real risk of significant harm to the individual.” Significant harm includes identity theft. PIPEDA states that an organization must notify impacted individuals, “as soon as feasible after the organization determines that the breach has occurred.”Some Medical Post readers suggested that the CFPC should provide compensation for affected members, but that might just increase member fees in the long run. A class action lawsuit might have the same effect, unless the CFPC has insurance to protect itself from this.The good news is that the hackers weren’t able to encrypt CFPC’s computer systems, and police know the overseas group responsible, the CFPC said. As of April, there was “no evidence that exfiltrated data are available on the dark web.”

Did CFPC inform docs about the cyber breach fast enough?

Register for free access or login.

Related Topics