Ransomware hits facility systems at Winnipeg's Health Sciences Centre
A ransomware attack discovered on Aug. 10 disrupted facility maintenance systems at Winnipeg's Health Sciences Centre (HSC), Manitoba's largest hospital, according to Shared Health, the provincial organization that runs it.
The incident drew attention because it struck building systems rather than clinical ones. Shared Health said the attack appears to have only impacted certain facility maintenance systems, a category that at HSC includes heating, ventilation and air conditioning (HVAC) monitoring and door access controls. Security researchers have long warned that hospital operational technology is often less protected than clinical networks.
What happened
Shared Health said patient care and clinical operations were not affected and that its investigation so far showed no indication patients were harmed. A later update said maintenance systems at CancerCare Manitoba, which shares the site, were also affected. Central HVAC monitoring went down, but the equipment kept running and was monitored locally. The hospital's security office temporarily could not issue or update ID access cards.
The health organization said it notified the Manitoba government, engaged outside experts and was treating the incident as a high priority. An early review suggested no personal health or financial information was accessed, though Shared Health said that work was continuing.
A week later, The Canadian Press reported the hospital was still working to restore systems. Manitoba's health minister said cybersecurity was a priority for the government after the attack.
Why it matters
The Manitoba Nurses Union raised safety concerns about door access at a site where it had previously complained about unsecured entrances. Union president Darlene Jackson told CBC that a breach allowing doors to be unlocked would be "a big concern for us."
A December 2024 report from Manitoba's auditor general had found that Shared Health had not tested its response to incident scenarios, including ransomware, during the audit period.
What we don't know yet
Shared Health has not said how the attackers got in or whether a ransom was demanded. No group claimed the attack in August, but on Oct. 11 the INC Ransom group listed the Health Sciences Centre on its leak site, according to the tracking site ransomware.live. Shared Health has not publicly addressed that claim.
What to do
Hospitals and other public facilities should inventory building-automation and access-control systems, keep them segmented from corporate networks, and include them in ransomware exercises alongside clinical systems.
