Lakelands Public Health has announced that around 60,000 current or former residents of Peterborough County and the City of Peterborough may have been affected by a cybersecurity incident first discovered at the end of January.
In a media release issued on Tuesday (June 30), the health unit says an unauthorized third party gained remote access to a limited portion of its network at Lakelands Public Health’s Peterborough office location.
According to the health unit, the third party accessed, extracted, and encrypted files containing personal information and personal health information from its servers. All files were successfully restored from backups.
“At this time through continuous monitoring and expert input, there is no evidence that the information involved has been misused for fraudulent purposes or published online,” Lakelands Public Health states in the media release.
Lakelands Public Health, which was formed through the merger of the Haliburton, Kawartha, Pine Ridge District Health Unit and Peterborough Public Health, says the incident may affect people who received services from its Peterborough location or whose health-related information, such as laboratory results, was received by the organization between 1996 and January 2026.
The information involved may include some combination of names, birth dates, home addresses, telephone numbers, OHIP numbers, medical diagnoses, medication information, treatment information, OHIP billing codes, dates of service, vaccination information, and healthcare provider information.
Lakelands Public Health says not every individual had all categories of information affected, with the type of information involved varying depending on the services they received.
The media release provides more details about the incident than were available when Lakelands Public Health first publicly disclosed the cybersecurity incident on February 3, after some internal systems were disrupted on January 29.
At that time, the health unit said it had secured its systems and activated its incident-response protocols after becoming aware of the incident and had engaged a third-party cybersecurity firm to investigate and contain the breach and support recovery efforts.
Lakelands Public Health said in February that systems used to manage infectious disease data and clinical appointments, including immunization and sexual health services, appeared not to have been affected.
In Tuesday’s release, the health unit notes it immediately isolated affected systems, contained the incident, launched an investigation with third-party cybersecurity experts, notified law enforcement, and strengthened network security measures.
Lakelands Public Health says it has also notified the Information and Privacy Commissioner of Ontario.
“Protecting personal information and personal health information in our care remains a top priority,” the health unit states, adding that it will “continue to monitor for any signs that the information involved has been misused or disclosed online” and will post updates on its website at www.lakelandsph.ca.
The health unit says that, based on the findings of cybersecurity experts, the risk of identity theft or fraud related to the incident is considered low.
However, residents are being advised to remain vigilant by monitoring personal accounts and statements, reporting suspicious activity to service providers or law enforcement, and being cautious of unsolicited communications requesting personal information.
Lakelands Public Health says it will never contact people by email or text message asking them to provide sensitive personal information.
Anyone with questions about the incident can contact Lakelands Public Health at 249-588-0044 from Monday to Friday between 8:30 a.m. and 4:30 p.m.
