A ransomware attack on TransForm, an IT service provider for five hospitals in southwestern Ontario, Canada, led to severe operational disruptions. Hackers from the Daixin Team breached systems on October 23, gaining access to a database containing 5.6 million patient visits and social insurance numbers of 1,400+ employees. The attack caused IT outages, forcing hospitals—including Windsor Regional Hospital, Erie Shores HealthCare, Hôtel-Dieu Grace Healthcare, Bluewater Health, and Chatham-Kent Health Alliance—to shut down email, Wi-Fi, and patient information systems, reverting to pen-and-paper records.Critical medical services were halted: cancer radiation treatments were canceled or transferred, surgeries postponed, and patients endured delays. The attackers destroyed backups, demanded a $4M ransom, and leaked hundreds of gigabytes of data—including COVID-19 vaccination records, diagnoses, and medications—threatening further leaks or sales to fraudsters. Hospitals refused to pay, citing patient suffering. The breach exploited weak passwords and lack of network segmentation, enabling lateral movement across systems. The attack directly threatened patient lives by disrupting time-sensitive treatments like cancer care and surgeries, while exposing highly sensitive health and employee data.

Five southwestern Ontario hospitals, supported by the IT services of TransForm Shared Service Organization, experienced significant disruptions due to a cyberattack. This incident led to the delay of medical procedures, including a crucial cardioversion, and left some patients waiting for extended periods, or even canceling treatments altogether. The hospitals were forced to revert to paper records as their online services, covering patient records and email communication, had been rendered inaccessible since Monday morning. The attack's extent necessitated the postponement of scheduled care and a plea for non-emergency patients to seek alternatives, highlighting the severe impact on hospital operations and patient care.