Around April 1^st, 2022, the County of Elgin was the target of a cyber incident and access to its network was gained through sophisticated means by an unauthorized third party.

 In connection with the cyber incident, certain County of Elgin data was accessed without authorization.  On May 3^rd, 2022, the County was alerted by our cybersecurity consultants that some of this data was posted on the “dark web” internet, part of the internet that you can’t find with traditional search engines such as Google. 

The County of Elgin values privacy and security and is enhancing safeguards and protections of its information and systems. 

The County has contained and remediated the cyber incident and is:

• transitioning to a more secure solution;
• cooperating with the Ontario Provincial Police; and
• working with external cybersecurity experts to investigate this matter and determine what happened, what data was impacted, and to whom the data belongs.

On May 13^th, 2022, the County of Elgin sent letters by Canada Post to impacted staff (current/former), retirees, as well as impacted residents (current/former) of Elgin’s Long-Term Care Homes where current physical addresses are available. At this point in our investigation, there is no evidence to show that general members of the public were impacted by the County’s data breach. 

The County has worked deliberately, while taking care to provide information to impacted individuals as quickly as it could. 

Unfortunately, cyber incidents like this are becoming much more common and while we have long had robust security protocols in place, tactics are constantly evolving. As a result, we are continuing to work hard to strengthen our defenses further.

We are working with a team of third-party cybersecurity experts to investigate the incident further and are taking all necessary steps to respond to it. The investigation is ongoing and we will share any relevant information as it becomes available.

The dark web is the World Wide Web content that exists on darknets: overlay networks that use the Internet but require specific software, configurations, or authorization to access.  It is the part of the internet that you can’t find with traditional search engines such as Google.  Because it is hidden, getting to the dark web isn’t easy. 

We have notified the Ontario Provincial Police, the Province’s Cyber Security Team, and the Information and Privacy Commissioner of Ontario.  Law enforcement’s investigation of this incident is ongoing and we will actively cooperate with the authorities as they conduct their investigation. 

We can’t provide additional information regarding the investigation at this time.

This incident does not appear to be a ransomware attack.  Ransomware is a malware designed to deny a user or organization access to files on their computer.  By encrypting these files and demanding a ransom payment for the decryption key which would allow an organization to regain access to their files.

We are working with a team of third-party cybersecurity experts to investigate the incident further and are taking all necessary steps to respond to it.  The investigation is ongoing, and we will share more information as it becomes available. 

While the investigation is ongoing, evidence shows that an unauthorized third party gained access to files containing personal information belonging to:

• some current and former staff of the County of Elgin; and
• some current and former residents of Elgin’s three (3) Long-Term Care Homes.

340 total individuals were impacted, 33 of which were highly sensitive and for whom credit monitoring and theft protection services will be provided. At this point in our investigation, there is no evidence to show that general members of the public were impacted by the County’s data breach. 

The County of Elgin takes the protection of data and privacy very seriously. We are in the process of completing a comprehensive external forensics audit to determine the exact scope of this breach.  For those individuals impacted by a sensitive personal breach, free credit monitoring and identity theft protection will be provided. 

The County of Elgin has no evidence to suggest that personal information was used to commit fraud or identity theft as a result of this incident. However, we do recommend that you remain vigilant and report any suspicious activity related to your personal information while the forensic audit is ongoing.

As a result of a thorough investigation, the County has identified individuals whose information was impacted by the County of Elgin data breach and, as of May 13^th, 2022, sent the appropriate individual notifications via Canada Post where physical addresses are available.  If the County does not have a physical address, but does have an email address, it has sent the notification via email.  The County has worked deliberately, while taking care to provide accurate information, as quickly as it could.

While the exact motivation of the incident is unknown, we continue to work diligently with leading cybersecurity experts to gain a full picture of events.  In the meantime, we recommend that you remain vigilant and report any suspicious activity related to your personal information while the forensic audit is ongoing.

The County of Elgin has no evidence to suggest that personal information was used to commit fraud or identity theft as a result of this incident.  However, we do recommend that you remain vigilant and report any suspicious activity related to your personal information while the forensic audit is ongoing.

If the forensic audit reveals that sensitive personal information has been accessed in some cases, we will notify those affected and take steps to protect them, including offering free credit monitoring services.

This is a complex situation, and as soon as we discovered the cybersecurity incident, we engaged a cyber-forensics firm to conduct a comprehensive investigation and assist in our remediation efforts.

We are still in the process of completing this audit to determine the exact scope of the breach.  Our commitment is to provide timely and transparent communication whenever possible.

The County was aware of the data posted to the Internet on May 3^rd, 2022.  Nonetheless, to gain a comprehensive and complete understanding of the full extent of the attack’s impact, a leading forensic cybersecurity firm was engaged to determine precisely what happened and what data was access or acquired without authorization. 

As part of that investigation, and to provide accurate information to impacted individuals, the County began analyzing the files, working with our external cybersecurity experts.  As part of that effort, the County initiated a process to conduct a careful inspection of each and every file to determine what information was potentially affected in order to be able to provide accurate information and to give notice to each individual whose personal information was impacted.

In addition to using sophisticated tools to parse and search the data, the County also conducted a manual review of each and every file. This was a labour-intensive and time-consuming process that involved hundreds of hours of detailed review and analysis.  The County used its resources to complete this investigation and analysis as quickly as it could, and, as of May 13^th, 2022, sent the appropriate individual notifications via Canada Post.

The County of Elgin takes the protection of data it holds very seriously.  If this process concludes that sensitive personal information was accessed, we will be taking additional steps to inform and protect those affected, including offering qualifying individuals free credit monitoring services. 

The County will update information on its website regularly https://www.elgincounty.ca/services/privacy-information/.

Around April 1^st, 2022, the County of Elgin was the target of a cyber incident and access to its network was gained through sophisticated means by an unauthorized third party.  In the following weeks, we were informed of phishing emails circulating in the community, which appeared to be coming from the County of Elgin or the Municipality of Central Elgin.

Upon learning of these phishing emails, we issued a press release to inform our staff and the community of this situation and recommended that caution be exercised when opening emails and associated attachments from any source.

This is a complex situation and on April 22^nd, 2022, we were working internally and with our team of external experts to determine the exact scope and nature of the incident. While that determination was not clear enough to share publicly at that time, it was important for the County of Elgin to communicate with its population regarding the risks associated with the phishing emails.

On discovering the situation, we immediately activated our IT security protocols to contain the threat, shut down access to our systems, reported the incident to relevant authorities including Ontario Provincial Police, and retain cybersecurity forensic experts to conduct a comprehensive investigation and to strengthen our systems.

We immediately acted to protect our infrastructure and are in the process of resuming normal operations.

Going forward, the County of Elgin will take several additional security measures to strengthen its systems, and our teams are working hard to resolve this situation as efficiently and responsibly as possible. 

When the County discovered the issue, it took the network offline and remediated the network.  The County has enhanced its security measures in a number of ways.

We are confident that the incident has now been successfully contained and remediation processes are well underway.

We are working with a team of experts as diligently and as quickly as possible to restore full functionality to the entirety of our system and resume normal operations.

Yes.  The County has reported the matter to the Ontario Provincial Police, the Province’s Cyber Security Team and to the Information and Privacy Commissioner of Ontario.  We will actively cooperate with authorities as they conduct their investigation and will continue to keep them apprised appropriately.