In 2019, a cyberattack saw LifeLabs’ computer system compromised, with millions of people’s personal information being leaked.
This leak impacted LifeLabs’ clients in BC and Ontario specifically.
In 2020, an investigative report was completed which found LifeLabs failed to comply with its obligations under British Columbia’s Personal Information Protection Act, as well as Ontario’s information protection act.
Specifically, the report revealed that LifeLabs did not take reasonable steps to safeguard the personal information and health information of millions of Canadians.
Following the cyberattack and subsequent breach, the Office of the Information and Privacy Commissioner for British Columbia (OIPC) issued several orders and a recommendation to address these failures which LifeLabs complied with.
However, back in 2020 when the report was to be published, LifeLabs claimed that it could not be released to the public because it contained privileged information.
Since then, LifeLabs has made a concerted effort to keep this data breach under wraps, but every attempt has been dismissed over the last four years.
“The road to accountability and transparency has been too long for the millions of British Columbians and people across the country who were victims of the 2019 LifeLabs cyberattack,” said Michael Harvey, Information and Privacy Commissioner for British Columbia.
“LifeLabs’ failure to put in place adequate safeguards to protect against this attack violated patients’ trust, and the risk it exposed them to was unacceptable. When this happens, it is important to learn from past mistakes so others can prevent future breaches from happening.”
The commissioner continued by saying that to learn from these types of lessons, they must be shared.
In a statement, LifeLabs stated that the orders and recommendations in the report have long since been addressed.
“LifeLabs is pleased that the matter has been resolved and is committed to applying the valuable insights gained from the joint investigation,” wrote a LifeLabs spokesperson.
“These findings are not only crucial for LifeLabs but also provide important lessons for all health information custodians facing the increasing challenges of cybersecurity.”
LifeLabs concluded by stating they remain dedicated to safeguarding health information and continuously improving their practices to address evolving risks.
