Sask. privacy watchdog could join probe of Lifelabs breach

SASKATOON For the first time, Saskatchewan’s Information and Privacy commissioner could be part of a multi-jurisdictional investigation, as he and the privacy watchdogs in Ontario and British Columbia look into a data breach reported by Lifelabs, one of Canada’s biggest medical lab service providers.

On Tuesday, the company, which has operations only in the three provinces, announced it had been hit by a cyberattack involving unauthorized access to its systems that contained customers’ names, addresses, login information, birthdates, health card numbers, and lab test results, primarily affecting customers in B.C. and Ontario.

Lifelabs’ president and CEO said in a statement posted on the company’s website that it paid a ransom and is now offering its customers free identity and fraud protection insurance for a year.

In Saskatchewan, Lifelabs’ operations are limited to collection at its 10 sites in Saskatoon and Regina; it’s a subcontractor of the Saskatchewan Health Authority.

A company spokesman said only customers’ names and login information used in its booking system were potentially exposed in the cyberattack. The company estimates 93,000 Saskatchewan residents would have at some point used the online booking system, which doesn’t include health card numbers or test results, and would be affected.

Lifelabs reported the breach to the office of Saskatchewan’s privacy commissioner, Ron Kruzeniski, on Friday. Kruzeniski said he has been in touch with the privacy commissioners in Ontario and British Columbia and asked if Saskatchewan could be added to the investigations in those provinces.

“My office has not had the opportunity to collaborate with other commission offices in this way,” he said.

“There had been one situation where it came close to the point of collaborating with another jurisdiction’s privacy commissioner, but this would be the first investigation of this kind, should the other commissioners agree to work together.”

The other offices were notified about the breach before Saskatchewan’s office. According to a Vancouver Sun report, Lifelabs contacted B.C. privacy commissioner Michael Mcevoy on Nov. 1.

The investigation is expected to add pressure to an office that is already experiencing a backlog of review reports. Kruzeniski said he does not yet know exactly how much pressure it will add.

“I would hope by working with B.C. and Ontario ... because it appears that they were contacted earlier, that they will have done some of the preliminary work. But no doubt it will add some pressure to our office.”

A Lifelabs spokesperson said the company informed authorities in the different jurisdictions based on when it received confirmation about the different systems affected by the breach. It first confirmed that one system, which held health card information and lab test results, affecting B.C. and Ontario customers, was breached and notified them. It later confirmed that a second system containing information of customers using its client booking system was also exposed and notified Saskatchewan authorities.

Lifelabs collects blood samples at its Saskatoon and Regina locations and provides them to the Saskatchewan Health Authority for testing.

In B.C. and Ontario, Lifelabs provides what the spokesman referred to as “end-to-end service.”