Security News > 2023 > September > MOVEit breach delivers bundle of 3.4 million baby records

BORN, which collates and uses information on "Pregnancy, birth, the newborn period and childhood to improve care," says it became aware of the incident on May 31 and notified relevant authorities, including the Ontario Provincial Police and the province's Information and Privacy Commissioner.

The perinatal and child registry collects data from healthcare providers, labs, and hospitals that provide pregnancy and child services.

"The personal health information that was copied was collected for a large network of mostly Ontario health care facilities and providers regarding fertility, pregnancy, newborn and child health care offered between January 2010 and May 2023," BORN said.

"An in-depth analysis revealed that the files copied during the breach contained personal health information of approximately 3.4 million people - mostly those seeking pregnancy care and newborns who were born in Ontario between January 2010 and may 2023.".

The criminals used a vulnerability exposed in Progress Software's MOVEit file transfer platform to breach the registry, BORN confirmed.

For those wondering if they're affected by the BORN incident, the answer is yes if your child was born in Ontario between April 2020 and May 2023; if you received pregnancy care in Ontario between January 2012 and May 2023; or if you had in-vitro fertilization or egg banking in Ontario between the start of 2013 and May 2023.

News URL

https://go.theregister.com/feed/www.theregister.com/2023/09/26/ontario_born_moveit_breach/