Customer Notification

Our investigations indicate that patient SIN numbers were not part of the information accessed: the cyber-attack involved unauthorized access to our computer systems with customer information that could include name, address, email, login, passwords, date of birth, health card number gender, phone number, security questions, and lab test results.

Our investigations to date indicate that the affected systems contained customer information that could include name, address, email, birth date, logins, passwords, health card numbers, gender, phone number, security questions and lab results.

At this time, we do not have any indication that financial information was compromised. Our cyber security firms have not seen any public disclosure of customer data from this attack in their investigation and surveillance of the dark web and other online sources.

As part of the public disclosure on December 17, 2019, LifeLabs informed all of our health care partners about the cyber-attack on our systems.  

In general, it is not necessary to get a new personal health number as the risk to customers is low.

In Ontario, if you have received a new OHIP card after January 2016, it is not necessary to get a new personal health number, but protections are available for concerned customers by contacting Service Ontario at 1-800-664-8988. If your OHIP card was issued prior to 2016 and you are concerned, please contact Service Ontario to issue a replacement.

In British Columbia, the Ministry of Health has advised LifeLabs that personal health numbers (PHNs) are not reassigned as a matter of practice, but additional protection can be added to your account by calling Health Insurance BC at 604 683-7151 or toll-free at 1 800 663-7100.

LifeLabs has a legal obligation to retain medical records, and as such, cannot delete results from our core systems.  

LifeLabs can delete any information we have collected as part of your online account creation.  We can delete your my results (Ontario) or my eHealth (British Columbia) and appointment booking account as well as any information collected as part of the creation of your account.

Ontario: To request that your my results account be deleted, please contact 1-844-379-2398.

British Columbia: To request that your my eHealth account be deleted, please contact 1-888-522-7758.

We are offering our customers cyber security protection for one year from TransUnion, which includes credit monitoring and fraud insurance protection. These services will give customers:

• Unlimited online access to the TransUnion Credit report, updated daily.
  • A credit report is a snapshot of a consumer’s financial history and primary tool leveraged for determining credit-related identity theft or fraud.
• Unlimited online access to the TransUnion CreditVision^® Risk score, with score factors and analysis updated daily.
  • A credit score is a three-digit number calculated based on the information contained in a consumer’s credit report at a particular point in time.
• TransUnion credit monitoring alerts with email notifications to key changes on a consumer’s credit file to protect against identity theft and enable quick action against potentially fraudulent activity.
• Dark Web Monitoring to provide monitoring of surface, social, deep, and dark websites for potentially exposed personal, identity and financial information in order to help protect consumers against identity theft.
• Identity theft insurance of up to $50,000 in coverage to protect against potential damages related to identity theft and fraud.

You can activate these services by calling the following number to receive a unique activation code to register for these services online.

1-888-918-0467

Please note that accepting the offer of credit monitoring does not prevent a customer from participating in any class action, if certified.

Following the discovery of the breach, LifeLabs has taken several measures to protect customer information:

• We immediately engaged world-class cyber security experts to isolate and secure the systems, and determine the scope of the breach;
• We are taking steps to further strengthen our systems to deter future attacks;
• We retrieved the data by making a payment. We did this in collaboration with experts who are experienced in cyber-attacks and in negotiations with cyber criminals;
• We engaged law enforcement, which are currently investigating the matter; and
• We are offering cyber security protection services to our customers, such as identity and fraud protection insurance.

There is no evidence of any public disclosure to date of test order information or test results of our customers resulting from this cyber-attack. We have retained cybersecurity firms, who are advising us based on their ongoing monitoring of the dark web and other online locations.