What happened
In November 2019, LifeLabs disclosed a cyberattack in which attackers accessed a system containing customer information including names, addresses, email addresses, login credentials, dates of birth, health card numbers, and lab test results.
A joint investigation by the Ontario and British Columbia privacy commissioners found LifeLabs had failed to take reasonable steps to protect the personal health information in its custody. Approximately 85,000 lab test results dated from 2016 or earlier were also exposed.
Reported impact: Undisclosed ransom paid, class-action settlements pending
Source: IPC Ontario, 17 Dec 2019.
What to do if you were affected
- Watch for phishing emails or phone calls referencing health services.
- Review any accounts secured by health card number.
- Enable two-factor authentication on your patient-portal accounts.
- Be cautious of unsolicited communications asking to verify medical information.
- Contact LifeLabs support if you receive suspicious communication referencing your lab results.
Common questions
When was the LifeLabs breach disclosed?
In December 2019. Public reporting was carried by IPC Ontario.
How many people were affected?
15,000,000 records, by the figure in the disclosure. Whether your own details were among them depends on your relationship with LifeLabs at the time.
How do I check whether my address was in it?
Enter the address in the check above. We check that one address against monitored breach databases and show what was exposed and what to do first. No account needed.
Is the data still a risk years later?
Often, yes. Lists from old breaches keep being copied and reused, so a password from one can still be tried today. Changing it, and not reusing it, closes that door.
Other breaches in this sector
Is your address in a public breach? Check my address →