Ungava Tulattavik Health Centre: Cyberattack of Nunavik health centre results in data breach

Cyberattack on Kuujjuaq Health Centre Exposes Clinical Records in 2025 Breach

The Ungava Tulattavik Health Centre (UTHC) in Kuujjuaq disclosed a cyberattack in November 2025, revealing that sensitive clinical and administrative records may have been compromised. Initially believed to have caused no data exposure, further analysis confirmed that files containing patient and employee information were potentially accessed by malicious actors.

UTHC detected the attack promptly, isolating the breach and securing its network. The health centre has since established a crisis unit, deployed enhanced surveillance tools, and notified financial institutions and local authorities. A joint investigation is underway with Québec’s Cyber Defence Operational Centre (CDOC), the Sûreté du Québec, and the Nunavik Regional Board of Health and Social Services (NRBHSS).

Officials described the incident as a "major" attack, likely carried out by organized cybercriminal groups. UTHC has set up dedicated support channels for affected users and employees, including email and phone contacts for inquiries. While the full scope of the breach remains under review, the health centre has emphasized its commitment to transparency and data protection.

Source: https://ca.news.yahoo.com/cyberattack-nunavik-health-centre-results-213510006.html

Nunavik Regional Board of Health and Social Services cybersecurity rating report: https://www.rankiteo.com/company/nrbhss

"id": "NRB1766037566",
"linkid": "nrbhss",
"type": "Cyber Attack",
"date": "11/2025",
"severity": "100",
"impact": "7",
"explanation": "Attack that could injure or kill people"

{'affected_entities': [{'customers_affected': 'Certain users and employees',
                        'industry': 'Healthcare',
                        'location': 'Kuujjuaq, Quebec, Canada',
                        'name': 'Ungava Tulattavik Health Centre (UTHC)',
                        'type': 'Healthcare Provider'}],
 'customer_advisories': 'Dedicated information service available for users and '
                        'employees (email and phone support). Urged vigilance '
                        'regarding bank activity and suspicious '
                        'communications.',
 'data_breach': {'personally_identifiable_information': 'Yes (users and '
                                                        'employees)',
                 'sensitivity_of_data': 'High (potentially sensitive personal '
                                        'and health information)',
                 'type_of_data_compromised': ['Clinical information',
                                              'Administrative information']},
 'date_detected': '2025-11-01',
 'date_publicly_disclosed': '2025-11-04',
 'description': 'Clinical records have potentially been exposed in a data '
                'breach of a Kuujjuaq health centre, which was the victim of a '
                'cyberattack orchestrated by malicious individuals in November '
                '2025. Preliminary analyses indicated no sensitive data was '
                'compromised, but recent information reveals that files '
                'potentially containing clinical and administrative '
                'information concerning certain users and employees may have '
                'been leaked.',
 'impact': {'brand_reputation_impact': 'Serious event with compromise of '
                                       'sensitive data',
            'data_compromised': 'Clinical and administrative information '
                                'concerning certain users and employees',
            'identity_theft_risk': 'High (users and employees urged to monitor '
                                   'bank activity and be alert to suspicious '
                                   'calls/emails)'},
 'investigation_status': 'Ongoing',
 'recommendations': 'Users and employees urged to regularly check bank '
                    'activity, monitor online transactions, be alert to '
                    'suspicious calls and emails, and never share passwords, '
                    'SINs, or credit card numbers over the phone.',
 'references': [{'date_accessed': '2025-11-04', 'source': 'UTHC Statement'}],
 'response': {'communication_strategy': 'Informed financial institutions, '
                                        'Nunavik mayors, and the public; set '
                                        'up a dedicated information service '
                                        'for users and employees',
              'containment_measures': 'Blocked the attack, plugged the breach, '
                                      'secured the computer network',
              'enhanced_monitoring': 'Yes (surveillance tools implemented)',
              'incident_response_plan_activated': 'Yes',
              'law_enforcement_notified': 'Yes (Sûreté du Québec)',
              'remediation_measures': 'Implemented surveillance tools for '
                                      'security, created a crisis unit',
              'third_party_assistance': 'Santé Québec’s Cyber Defence '
                                        'Operational Centre (CDOC), Sûreté du '
                                        'Québec, Nunavik Regional Board of '
                                        'Health and Social Services (NRBHSS)'},
 'stakeholder_advisories': 'Informed financial institutions and Nunavik mayors '
                           'of the incident.',
 'threat_actor': 'Organized and professional groups',
 'title': 'Cyberattack on Ungava Tulattavik Health Centre (UTHC)',
 'type': 'Data Breach'}