Cyberattack recovery costs hit $8.9M for SW Ontario hospitals — so far

Recovery efforts in the months following the cyberattack against five southwestern Ontario hospitals and their service provider cost almost $9 million — and that work is still ongoing.  

The targeted agencies — who refused to pay an US$8 million ransom demand — each paid hefty costs in the fallout of last October’s ransomware assault in the final months of the 2023-2024 fiscal year. 

Article content

“The attack caused a prolonged disruption, and we remained in downtime until January 2024 when our electronic medical record was brought back up in limited capacity,” Marlene Kerwin, CFO and vice-president of Corporate Services at Bluewater Health, said in an emailed statement.

“We have ongoing costs associated with the attack in the 2024-2025 fiscal year as we continue to recover systems and work on transitioning to our new hospital information system with a planned go-live in November 2024.” 

Windsor Regional Hospital, Erie Shores HealthCare, Hôtel-Dieu Grace Healthcare, Chatham-Kent Alliance, Bluewater Health, and their shared service provider, Transform Shared Service Organization, all fell victim to the October cyberattack.   

The Windsor Star reported in November that the hackers demanded a ransom of about US$8 million, which the hospitals refused to pay. Cybersecurity experts have said that was the right move. 

The total cost of recovery efforts between late October and the end of the 2023-2024 fiscal year in March was about $8.9 million.

All clinical systems have since been restored. 

Article content

Windsor Regional Hospital has spent the most during the recovery process so far. 

According to its annual financial statement, the cyberattack cost the hospital $3,884,000 in the 2023-2024 fiscal year. Only about $1.5 million is “recoverable” through the hospital’s insurance provider. 

But Windsor Regional Hospital CEO David Musyj, who has since been seconded to run London Health Sciences Centre, also said earlier this year that a full recovery would likely take all of 2024. 

Hospital spokesperson Steve Erwin said the bulk of the cyberattack costs during the last fiscal year came from paying staff overtime.

“One-time costs occur when unexpected issues need to be addressed and fall outside of routine budget expectations,” he told the Star in an email. 

“Obviously there was a cost to ensure and protect patient care delivery during the cyberattack as best we could under difficult circumstances instigated by criminals.” 

Transform told the Star it spent approximately $700,000 last fiscal year on recovery efforts. Communications specialist Juhayna Helmy said Transform will be seeking coverage for a “substantial portion” of the costs through insurance, but it’s still unclear what the breakdown will be. 

Article content

“Transform worked diligently with its member hospitals to restore services as quickly as possible recognizing the impact of the cyberattack on the community, patients, families, physicians and staff,” said Helmy. “TransForm is proud of its partnership with its member hospitals to restore complex clinical services while not negotiating with cyber criminals.” 

Hôtel-Dieu Grace Healthcare said it incurred costs of about $600,000. It did not state how much, if any, its insurer covered.  

Erie Shores HealthCare in Leamington also said it spent about $600,000 dealing with the cyberattack in the previous fiscal year. The hospital said that amount was covered by insurance providers.

“These unexpected expenses, which fall outside of our routine budget, were necessary to address the challenges posed by the attack,” said Kevin Black, the hospital’s manager of communications, community engagement and public affairs. 

Bluewater Health said it spent more than $2 million in the 2023-2024 fiscal year dealing with cyberattack issues. Insurance covered about half of that.  

Chatham-Kent Health Alliance said its cost for dealing with the cyberattack for the 2023-2024 fiscal year was about $1.1 million. 

“The attack caused a lengthy disruption,” said Fannie Vavoulis, the health alliance’s director of communications and patient experience. “Despite the challenges, we maintained our commitment to safe, quality patient care throughout this period.” 

 twilhelm@postmedia.com

Article content