Last updated: January 24, 2025
This webpage includes answers to frequently asked questions about a data security incident that Michael Garron Hospital experienced on October 23, 2023. In November 2024, this webpage was updated to include information about affected Michael Garron Hospital patients and affected Michael Garron Hospital Foundation donors.
On October 23, 2023, Michael Garron Hospital experienced a data security incident. While critical information and clinical application systems were uninterrupted, data stored on one of Michael Garron Hospital’s servers was exposed. Our patient health information database was not compromised.
We immediately took steps to protect our data and information systems. We also immediately launched an investigation into the incident in collaboration with leading third-party experts and notified the appropriate stakeholders of the incident and our investigation. These stakeholders included our employees, credentialed clinicians, learners and volunteers; patients and community members; Michael Garron Hospital Foundation donors; and our hospital and foundation Boards of Directors.
In November 2023, we confirmed the exposed data included personal information belonging to certain individuals, including current employees and credentialed clinicians, as well as certain former employees and credentialed clinicians, board members, learners and volunteers at Michael Garron Hospital. We notified these affected individuals between November 2023 and January 2024. We also confirmed that this data included personal health information belonging to some patients at Michael Garron Hospital and personal information belonging to some Michael Garron Hospital Foundation donors.
In fall 2024, after concluding an investigation with leading third-party experts, we notified affected patients at Michael Garron Hospital and affected Michael Garron Hospital Foundation donors through the hospital website. This notice is also accessible through Michael Garron Hospital Foundation’s website.
We have confirmed that the data security incident was perpetrated by a cyber threat actor group. Please note that, at this time, we have no evidence that any personal information, including personal health information, was misused.
Our programs and patient care services continue to operate normally and Michael Garron Hospital remains a safe place to receive care. In addition, it is safe to donate to Michael Garron Hospital Foundation. The foundation website, mghf.ca, is secure and our donation webpages encrypt donor information ahead of transmission to a third-party payment processor.
We wish to thank everyone who responded to this incident, including our healthcare teams, community partners, government agencies and law enforcement services. We also want to thank our patients, community members, staff, credentialed clinicians and Michael Garron Hospital Foundation donors for their patience and ongoing support.
Although Michael Garron Hospital and Michael Garron Hospital Foundation are two separate entities, we work together closely and share certain resources, including Information Technology (IT) infrastructure.
We worked with law enforcement and government agencies throughout our response to this incident. We have also been in communication with the Information and Privacy Commissioner (IPC) of Ontario. We are grateful for their continued support.
Our investigation revealed that the following information was exposed. Please note that, at this time, we have no evidence that any personal information, including personal health information, was misused.
We have invested significantly in additional security measures to better protect our hospital network and information systems, and to ensure the security of the data that Michael Garron Hospital and Michael Garron Hospital Foundation store. This includes upgrading cybersecurity software, enhancing existing network and information systems, and engaging leading third-party experts to monitor the potential misuse of exposed data. We also continuously review our policies and procedures to help prevent future incidents.
We notified current employees and credentialed clinicians of the incident by email on November 10, 2023. We began notifying affected former employees and credentialed clinicians by mail during the week of November 27, 2023.
We notified affected current and former board members, learners and volunteers by email or mail in January 2024. We notified affected Michael Garron Hospital patients and most affected Michael Garron Hospital Foundation donors through the hospital website in November 2024. This notice is also accessible through Michael Garron Hospital Foundation’s website. We also notified certain donors by mail in November 2024. Please note that delivery of this mail may be delayed by service disruptions at Canada Post.
We notified current employees and credentialed clinicians of the incident by email on November 10, 2023. We began notifying affected former employees and credentialed clinicians by mail during the week of November 27, 2023. We notified affected current and former board members, learners and volunteers by email or mail in January 2024. We notified certain donors by mail in November 2024. Please note that delivery of this mail may be delayed by service disruptions at Canada Post.
We notified affected Michael Garron Hospital patients and most affected Michael Garron Hospital Foundation donors through the hospital website. This notice is also accessible through Michael Garron Hospital Foundation’s website.
We previously reported that our investigation into the exposure of Michael Garron Hospital patient and Michael Garron Hospital Foundation donor information was ongoing, and that this investigation would likely take weeks or months to complete. This investigation was complex, and it took time to determine what information was exposed. We take the protection of personal information, including personal health information, very seriously and will continue to be as open as possible.
If you are an employee or credentialed clinician at Michael Garron Hospital, the exposed information includes the information listed in the email or mail you received between November 2023 and January 2024. If you are also a patient at Michael Garron Hospital, then your exposed information may also include the information listed in the notice posted on the hospital's website. Please note that, at this time, we have no evidence that any personal information, including personal health information, was misused.
Thank you for your philanthropic support. If you are an employee or credentialed clinician, the exposed information includes the information listed in the email or mail you received between November 2023 and January 2024. If you are also a Michael Garron Hospital Foundation donor, then your exposed information likely includes the information listed in the notice posted on the hospital website. This notice is also accessible through Michael Garron Hospital Foundation’s website. Please note that, at this time, we have no evidence that any personal information, including personal health information, was misused.
Patients whose personal health information was exposed have the right to file a complaint. Should you wish to do so, you can contact the Information and Privacy Commissioner of Ontario (IPC) via its website (ipc.on.ca/en/resources/information-individuals). While you are welcome to file a complaint with the IPC, it is not necessary to do so as the IPC is already investigating this matter.
Michael Garron Hospital and Michael Garron Hospital Foundation provided a free two-year credit monitoring subscription to individuals whose exposed information may place them at an elevated risk of identity fraud.
We offered a free two-year credit monitoring service for individuals affected by this incident whose exposed information may place them at an elevated risk of identity fraud. Instructions on how to access this service are included in the email or mail you received.
In this email or mail, we shared an enrollment code and instructions for how to register for this service. This protective service is of significant benefit and we encourage recipients to take advantage of it.
If you experience any technical difficulties accessing these services, please contact TransUnion at 1-888-228-4939.
If you are already enrolled in credit monitoring services with TransUnion, you can use the code we provided you to extend your period of coverage. To do so, please contact TransUnion at 1-888-228-4939 for assistance.
No, enrolling in the credit monitoring service will not affect your credit score. We encourage eligible individuals to enroll in this service to protect themselves.
We recommend enrolling in the free two-year credit monitoring service offered by Michael Garron Hospital and Michael Garron Hospital Foundation through TransUnion if you are offered it. You may also consider the following:
Yes, after the two-year period, you may enroll in TransUnion’s credit monitoring service on their website. You may also contact TransUnion at 1-888-228-4939 for support.
Michael Garron Hospital retains employee information to comply with income tax remittance laws and regulations. The hospital is required to maintain relevant financial records for a minimum of seven years.
Michael Garron Hospital retains personal health information in accordance with the Public Hospitals Act, which generally requires it to retain personal health information for 10 years after a patient receives care.
Canada Revenue Agency requires that registered charities maintain records and supporting documents for a period of six years from the end of the last tax year to which they relate. Michael Garron Hospital Foundation also keeps information of lapsed donors in hopes of keeping them engaged.
If you have a donor-related question that is not addressed in the FAQ, please contact @email. If you have a patient-related question that is not addressed in the FAQ, please contact @email or 416-469-6096.
If you are a member of the media, please contact @email.
