You've been notified by a hospital that your information was stolen. Now what?

When Nicole Wilson first saw a letter in the mail from Windsor Regional Hospital telling her that her personal information has likely been exposed, she says she "panicked." 

"I called my husband right away and was like, 'oh my God, so what do I do now?' said Wilson. 

"How do I find out if my information is at risk and what's at risk?" 

Wilson is one of 326,000 patients whose information was stolen during a cyberattack incident last year. She and many others have started receiving letters from one (or more) of five southwestern Ontario hospitals impacted, notifying them that their information was likely leaked on the dark web. 

"I still have questions because it doesn't really give any information in the letter," said Wilson, adding she wants to know the exact information that could have been exposed. 

On Oct. 23, IT provider TransForm Shared Services — which supports Windsor Regional Hospital, Hôtel-Dieu Grace Healthcare, Erie Shores HealthCare, Chatham-Kent Health Alliance and Bluewater Health in Sarnia — experienced a ransomware attack. 

Computer systems at all of the hospitals were offline for several weeks, as hackers took control and stole personal patient and employee information. The attackers attempted to get the hospitals to pay a ransom, but the hospitals said they refused to pay. 

Since then, the hospitals have worked on restoring their software and, earlier this month, said they would start notifying people whose information was likely impacted. 

But for many, there's concern about what this means and uncertainty on what to do next. 

Saeed Samet, associate professor at the University of Windsor's School of Computer Science, says there's a lot that needs to be done when a ransomware attack first takes place. 

In this case, Samet said the IT provider TransForm and the hospitals were likely focused on trying to continue to provide service to their patients and try to get their systems back online as quickly as possible. 

"The very first priority will go to those things," he said. 

"They have to have some type of restoration of information to make sure that some sensitive operations will be not in much delay."  

And it's often not immediately clear what information has been taken.