In an open letter penned to its customers, Life Labs, one of Canada’s largest medical laboratories, recently admitted that it had become aware of a major data breach potentially affecting 15 million customers. Addresses, passwords, birthdays, health card numbers, logins and lab results were accessed and stolen by hackers in a breach that was identified in October, however the company waited until December to notify its customers.
Life Labs paid an undisclosed amount in order to secure the data from the hackers and is advising, “… the risk to our customers in connection with this cyberattack is low.” Security experts and advisers are advocating this to be the wrong decision leaving the door open to encourage more cyber criminal activity knowing that large companies such as Life Labs will pay a ransom to secure their data. This move in turn will suggest that if Life Labs’ defenses can once again be penetrated, there will likely be another payoff. On top of risking future attacks, the “promise” of receiving access to the locked/stolen data is not a guarantee by any means and as it can still end up on the Dark Web, exposed or used in other phishing attacks.
Being such a large scale breach that potentially affects almost 40% of Canada’s population, all eyes are on Life Labs and thus far critics are not pleased with the way the company has handled the attack. With class action lawsuits in the works and ongoing investigations, the company is sure to be setback with heavy costs associated with remediation and recovery for some time.
If you’ve been affected by this breach, Life Labs is offering free Dark Web Monitoring and Identity theft Insurance for one year. Details can be found on their website.