Ontario reveals how many people were impacted by COVID-19 vaccine portal breach

A security breach linked to Ontario’s COVID-19 vaccine portal exposed the personal information of approximately 360,000 people in the province.

Those who are impacted will start receiving email notices on Friday if their personal information was part of this breach.

“In over 95 per cent of cases, only names and/or phone numbers were impacted,” Ontario’s Ministry of Public and Business Service Delivery said in a statement on Friday.

On Nov. 16, 2021, the Ontario Provincial Police (OPP) launched an investigation after reports surfaced of spam text messages received by individuals who scheduled appointments or accessed vaccine certificates through the COVID-19 immunization system.

Since then, investigators have been working towards determining the scale and impact of the breach.

A week later, two people were charged – one of the individuals was a government employee.

Twenty-one-year-old Ottawa resident Ayoub Sayid and 22-year-old Rahim Abdu from Quebec were both charged with Unauthorized Use of a Computer contrary to s. 342.1(1)(c) of the Criminal Code.

“Ontario’s COVID-19 vaccine booking system is regularly monitored and tested as part of the Ministry of Health’s cyber security protocols and we remain confident that the booking system continues to be a safe and secure tool for Ontarians to use,” the minister said. 

HOW DO I KNOW IF I WAS IMPACTED?

Ontarians whose data was exposed during the breach will receive an email with the subject: Personal Health Information Notification.

The email is penned by the Chief Information Officer and Assistant Deputy of the Minister Provincial Vaccine Contact Centre.

The email begins with the following: “I am contacting you to notify you about a privacy breach that involved your personal health information registered in the COVID-19 immunization system used by the Provincial Vaccine Contact Centre and vaccine administrators at clinics across the province.”

The email explains that in recent months, the OPP investigation led to a list of people impacted by this privacy breach based on evidence seized.

It then goes on to say, “The accused’s laptops seized by the OPP contained your name and phone number.”

“I assure you the COVID-19 immunization system is regularly monitored and tested as part of our cyber security protocols to ensure the safety of the COVID-19 system and we are confident in the security of the data currently in the system,” the email concludes. 

With files from CTV News Toronto's Katherine DeClerq.