Live data from Hacker News

LifeLabs pays ransom after data breach affecting up to 15M Canadians

theglobeandmail.com

31–40 of 53 posts

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#31
post #2

If you don’t live in Canada, you might not know that LifeLabs has a virtual monopoly on the lab business. If your doctor wants you to take a blood test, you go to LifeLabs. Whomever broke into their systems knows a great deal about the private health information of a large fraction of Canadians.

In the US this title seems to be held by Quest diagnostics.

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#32

“For customers who are concerned, LifeLabs has offered to cover one year of data protection that includes dark web monitoring as well as identity theft insurance.” That’s it? If I was Canadian I’d want to see execs going to jail and or their contract yanked. If they switched over to using a webapp or chromeos on the desktop things would probably be much more secure. But that’s not going to happen, cuz it’s owned by t…

Canadian here. I asked my federal MP why there are no criminal consequences and my provincial MLA why BC is not terminating their contract.

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#33

“For customers who are concerned, LifeLabs has offered to cover one year of data protection that includes dark web monitoring as well as identity theft insurance.” That’s it? If I was Canadian I’d want to see execs going to jail and or their contract yanked. If they switched over to using a webapp or chromeos on the desktop things would probably be much more secure. But that’s not going to happen, cuz it’s owned by t…

Does anyone know what “dark web monitoring” actually involves, and what sorts of firms provide this kind of service?

It's called Snake Oil Consulting Inc and the sorts of firm that has very very good contacts to the federal gubmint...

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#34

Earlier quoted context omitted.

There's something in this story that doesn't ring true. You knew from the moment you walked into the laboratory that their data handling practices were inadequate and prone to being hacked/leaked. How? You tried to explain this to their secretaries and nurses. Why bother when it's obvious they can't/won't do anything about it? Why not contacting their management or IT?

To be fair to life labs, at least they don’t dox you aloud to an entire waiting room. I witnessed that happen to a few prominent financiers in Toronto while I was getting some bloodwork done. It was terrifying within about 5 minutes I had all the personal information I’d need to do some seriously nefarious things. This happens on most every occasion I visit a clinic in Canada. Nurses and secretaries do not care.

Happens in the US too. As I was waiting for my doctor's appointment, I was just listening to the secretary call up patients to obtain payments. She was just reading out their credit card information out loud. I was honestly tempted to just take one down then call the credit card company to let them know it was compromised.

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#35
post #2

If you don’t live in Canada, you might not know that LifeLabs has a virtual monopoly on the lab business. If your doctor wants you to take a blood test, you go to LifeLabs. Whomever broke into their systems knows a great deal about the private health information of a large fraction of Canadians.

In the US this title seems to be held by Quest diagnostics.

Well Quest but also LabCorp. If we go on employee count, then LabCorp would have the bigger hold. I can't tell if Sonora Quest and Bioreference are subsidiaries of either of these two larger companies.

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#36
post #2

If you don’t live in Canada, you might not know that LifeLabs has a virtual monopoly on the lab business. If your doctor wants you to take a blood test, you go to LifeLabs. Whomever broke into their systems knows a great deal about the private health information of a large fraction of Canadians.

In the US this title seems to be held by Quest diagnostics.

There's also LabCorp.

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#37

“For customers who are concerned, LifeLabs has offered to cover one year of data protection that includes dark web monitoring as well as identity theft insurance.” That’s it? If I was Canadian I’d want to see execs going to jail and or their contract yanked. If they switched over to using a webapp or chromeos on the desktop things would probably be much more secure. But that’s not going to happen, cuz it’s owned by t…

Canadian here and one who has records potentially leaked.... In terms of reaction, I dunno... It depends where on the spectrum of We kept our "passwords on sticky notes on Windows XP monitors" to "We did everything industry best practices and then some" did they fall into.... I havent seen anything with respect to technical details.

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#38

Just a few months ago I had to take a series of tests with LifeLabs (blood, urine, physical, etc) to update my immigration papers. Did you know you cannot choose where to take these tests? You are more or less forced to use LifeLabs because the doctors designated by the IRCC (Immigration, Refugees and Citizenship Canada) only partner with LifeLabs to do these tests, it’s an ugly monopoly that is impossible to fight a…

> You are more or less forced to use LifeLabs because the doctors designated by the IRCC (Immigration, Refugees and Citizenship Canada) only partner with LifeLabs to do these tests, it’s an ugly monopoly that is impossible to fight as an immigrant.

The other main option is Dynacare. Besides those two, who else is there? Both have built up convenient infrastructure where results are fed back into doctors' EHR systems.

I wouldn't be against more competition, but it seems that there are certain economies of scale that make bigger more efficient:

* https://healthydebate.ca/2015/02/topic/private-medical-labs-...

* https://toronto.citynews.ca/2017/12/22/lab-industry-need-ove...

Side note: LifeLabs is owned by the OMERS pension fund.

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#39

Just a few months ago I had to take a series of tests with LifeLabs (blood, urine, physical, etc) to update my immigration papers. Did you know you cannot choose where to take these tests? You are more or less forced to use LifeLabs because the doctors designated by the IRCC (Immigration, Refugees and Citizenship Canada) only partner with LifeLabs to do these tests, it’s an ugly monopoly that is impossible to fight a…

“One must imagine Sisyphus happy.” —Albert Camus, The Myth of Sisyphus

I like to think of Sisyphus a bit like someone waiting in line for a rollercoaster or a ski lift. The pushing is a slog, but then you reach the top and WOW BOOOM the rock cascades down the hill and it's AWESOME! Time to start pushing it back up again.

Yes yes I know Sisyphus is a metaphor for the pointlessness of life - but that doesn't mean you have to take it at face value.

Re: LifeLabs pays ransom after data breach affecting up to 15M Canadians

#40

Just a few months ago I had to take a series of tests with LifeLabs (blood, urine, physical, etc) to update my immigration papers. Did you know you cannot choose where to take these tests? You are more or less forced to use LifeLabs because the doctors designated by the IRCC (Immigration, Refugees and Citizenship Canada) only partner with LifeLabs to do these tests, it’s an ugly monopoly that is impossible to fight a…

>Did you know you cannot choose where to take these tests?

Welcome to the Canadian Healthcare system. It's free, but not without issue, even ignoring the long wait times and inability to get a doctor in most places in the country.

Did you know I'm not allowed to go get my blood tested privately, even if I pay for it? That I require a requisition from a doctor (which I don't have, so I have to go to a walk-in clinic and take up the time of a doctor who could care less what they are signing)? And that the results then get shared back with said doctor, who's discretion it is what data he shares with me? It's bizarre.

I often see Americans pointing to Canada's system as a shining example. I mean, sure, we don't have crushing medical debt, which is AWESOME. But our healthcare system has so many problems itself...

Post reply on HN