Doctors hacked through CFPC website and the CFPC offers no compensation

Did you receive this from the College of Family Physicians of Canada on April 4, 2024? I will cut to the chase and highlight the important bits but leave the legalese. But first, here’s what I received: Dear Dr. [Blank],The College of Family Physicians of Canada (“CFPC”) takes the security of personal information in our care very seriously. Regrettably, we are writing to advise you of a cybersecurity incident with implications for some of your personal information. The purpose of this letter is to inform you of the incident, the steps we are taking to bolster the protection of personal information in our custody and provide you with information on additional steps you can consider taking should you wish to do so."What Happened? On October 25, 2023, our network security and monitoring vendor identified suspicious activity in our network. We responded immediately and took steps to contain and isolate the threat and deployed countermeasures to prevent against further unauthorized access to our network. We also retained third-party cybersecurity experts to assist with containment, remediation and to conduct a forensic investigation to determine the nature and scope of the incident.Our cybersecurity experts determined that the unauthorized third party accessed and copied data from our network prior to attempting to deploy malware to encrypt our systems. Fortunately, our response efforts alleviated the encryption threat but we were unable to prevent data being copied. We have since conducted a thorough review of the data involved in this incident and identified that it contained personal information belonging to certain of our members.What Information Was Involved?Our review of the data involved revealed some or all of the following types of your personal information: name, address, date of birth, email address, telephone number, medical license number, and payment receipts for membership dues.Please note that we have no evidence to suggest that any of your personal information has been misused for any fraudulent purposes or has been sold or disclosed to any other third parties. Nevertheless, we appreciate that you may have concerns and wanted to notify you of this incident out of an abundance of caution. What Are We Doing?Since discovering this incident, we have consulted with cybersecurity experts about ways to better prevent against an incident of this nature from occurring again and have implemented enhanced security measures. We are also notifying all affected individuals out of an abundance of caution to help further secure their personal information.What You Can DoWhile we have no evidence that your personal information has been misused for any fraudulent purposes, it is always advisable to remain vigilant by taking the following steps to protect yourself:If you receive emails, letters, telephone calls or text messages in the days ahead purporting to be from CFPC and asking that financial or any other personal information be shared via email or phone, and which is not related to your upcoming membership renewal, please consider the communication to be fraudulent, or contact us to confirm its authenticity.Never respond to any unsolicited requests for your personal or financial information.Monitor your bank accounts and credit history to guard against any unauthorized transactions or activity. If you have any doubts or notice any suspicious or potentially fraudulent activity on your credit or debit card, we recommend you contact your financial institution and report the incident to law enforcement immediately.Remain vigilant of any phishing or spoofing attempts. Spoofing is an impersonation tactic used in phishing campaigns to deceive individuals into thinking that a communication, either a letter or email, came from a trusted source and to leverage that to obtain further information or defraud the recipient.Avoid clicking on links or downloading attachments from suspicious emails.Additional tips and resources for protecting your identity are available at: https://www.priv.gc.ca/en/privacy-topics/identities/identity-theft/guide_idt/.For More InformationWe apologize for any inconvenience or concern this incident may cause you. If you have questions regarding this notice, you can contact us at 1-888-680-7702 between the hours of 9:00 a.m. to 9:00 p.m. EST Monday to Friday, and one of our representatives will be happy to assist you. Thank you for your patience and understanding. Sincerely,Nancy Fowler,Deputy Chief Executive OfficerAlright, let me interpret the above for you: Doctor, someone stole your data from the CFPC website 162 days ago. Instead of informing you immediately, we consulted cybersecurity experts and lawyers and are now dumping the onus on you 0.44 years later without any compensation. You may call us Monday to Friday to complain to an underling who will make sad noises at you.Observe the level of service offered to family doctors who pay $1,000/year (highest was $1,133 in Alberta and lowest was $823 in the Territories in 2023).My relative was affected by the data leak at Desjardins credit union, and at least Desjardins offered five years of credit monitoring service through Equifax (if you're one of the 4.2 million Canadians also affected by Desjardins, the Quebec court approved a $200.9 million class action settlement).Meanwhile, the platinum-fee CFPC offers nothing except one apology at the end of a very long and even more delayed notification.What should we do now?Check your email. How many of us have been affected by the CFPC leak?Notify your financial institutions.One of mine kindly wrote back: “I am sorry to hear this. At [our institution], we use a pop-up note (similar to security notice) which will inform all the departments of the privacy breach. I will go ahead and ask our back-office to add the notice immediately.”However, a bank rep told me I should watch my account every day and notify them of any strange transactions. I said that was unacceptable and I needed to talk to the supervisor. There was no supervisor on the weekend and I should call back on Monday.Yes, this is a colossal waste of time. Identity theft is even worse 3. Head to Equifax. You can pay $25/month to monitor your credit rating.At minimum, you can set up an alert. Click the orange button for START YOUR DISPUTE and fill out the form. Requires at least two proofs of identity.Transunion also has a monthly surveillance plan. Their website is a chore, and they, too, had been hacked in 2022. However, they're our other credit bureau, so you'll need to cover both of them.For the minimum of setting an alert on your account, you can use this direct link—otherwise, you'll end up at .com, stuck on the American site.Other doctors have raised the following points:They leaked our addresses, so now vindictive patients (or anyone) can come after us in our homes.$700 of annual credit card monitoring means a minimum of $20,000 over a lifetime, as you can be assured that they will raise their prices, and I hope we all live over 29 more years. 4. Be sure to let the CFPC know when you give them an earful.Another anonymous poster kindly wrote a template for you to use:Dear CFPC,Firstly, thank you for informing me of this occurrence.I must admit, however, that it is quite disheartening to hear this news, let alone hearing of it over five months in retrospect.I now have to carry a lifelong worry of identity theft and financial compromise due to the inadequacy of security measures and policies held in place by the CFPC.And yet, somewhat astonishingly, the recompense offered by the CFPC amounts to less than nil—boldly recommending us to take on the added stress and work of diligently monitoring for identity theft.Frankly, this is unacceptable.The cost of identity theft monitoring services across Canada's two credit unions totals to nearly $60.00 per month ($24.95 per month plus tax for TransUnion and Equifax respectively). This amounts to nearly $700.00 ANNUALLY, or nearly $20,000.00 over the span of a 30-year working career (which is not unreasonable to consider as the data will likely now be accessible to illicit actors indefinitely). Of course, this cost is only assuming no price increases over time (which is unlikely).As such, I feel it is only appropriate that the CFPC offer affected members some form of monetary compensation, whether by way of a waiving of the CFPC examination fee (for residents) and/or to cover the cost of credit monitoring services across both unions for a period of several years.I have been in touch with various other affected members who feel similarly and who will be reaching out.The way this situation is currently being handled does not leave much trust or faith in the CFPC as an organization that represents family doctors.I look forward to hearing how the CFPC will rectify the harm caused to its members as a result of this incident. 5. I would look into cancelling the CFPC membership, but apparently this is no longer an option. Yet another mandatory membership fee, along with $2,000 your provincial college, $2,000 to your provincial medical association, and (I don't begrudge this one) medical protection.If you have any further advice, let's put our minds together to try and mitigate the damage.This post was written by a doctor who asked to remain anonymous.

Doctors hacked through CFPC website and the CFPC offers no compensation

Register for free access or login.

Related Topics