Newfoundland and Labrador health-system cyberattack

Beginning 30 October 2021, a Hive ransomware attack brought the health-care system of Newfoundland and Labrador to a standstill, in an incident the province's officials described as the worst cyberattack in Canadian history. The assault crippled IT systems across multiple regional health authorities and forced clinicians back to paper records for weeks.

What happened

The intrusion began on 15 October 2021, when attackers logged into the Newfoundland and Labrador Centre for Health Information network through a VPN using stolen credentials. Over the following two weeks they escalated to administrative access and moved laterally into connected systems. On 30 October, the operators deployed Hive ransomware, encrypting numerous servers and triggering a sweeping outage.

The hardest hit was Eastern Health, the province's largest health authority, serving the St. John's metropolitan area. Diagnostic imaging, lab systems, email, and scheduling all went dark. Health workers reverted to pen and paper to track patient care, and the province was forced to cancel thousands of appointments and procedures, including diagnostic imaging, chemotherapy sessions, and surgeries.

Impact

• A province-wide health IT outage lasting weeks, with degraded systems persisting far longer.
• Thousands of cancelled appointments, including cancer care and surgical procedures.
• The province confirmed that personal and health information of both patients and employees was accessed, including in some cases data going back decades for current and former staff.
• Clinicians across multiple regional authorities reverted to manual, paper-based processes.

Attribution and aftermath

For more than a year the province declined to name the perpetrators or confirm whether a ransom had been demanded or paid. In February 2023, Newfoundland and Labrador officially attributed the attack to the Hive ransomware group, a prolific ransomware-as-a-service operation. By then, an international law-enforcement coalition led by the U.S. Department of Justice and Europol had dismantled Hive's infrastructure in January 2023, seizing its servers and decryption keys.

Why it matters

The Newfoundland and Labrador attack is a landmark example of ransomware as a threat to public health and safety, not merely data privacy. It exposed how a single set of stolen VPN credentials could cascade into a province-scale healthcare crisis, delaying urgent care for cancer and other patients. The incident reshaped Canadian discussions about critical-infrastructure cyber resilience, network segmentation, multi-factor authentication for remote access, and the duty of governments to disclose breaches promptly — a duty the province was widely criticized for not meeting quickly enough.