Listen to this article
Estimated 5 minutes
The audio version of this article is generated by AI-based technology. Mispronunciations can occur. We are working with our partners to continually review and improve the results.
A human resources expert says a visceral response to a cybersecurity test email that falsely promised all employees a paid day off highlights the divide between Newfoundland and Labrador Health Services and its strained workforce.
“If people in the organization already felt their contributions were valued, and that the organization cared about their well-being, then they wouldn’t have had this reaction to the scam which kind of tricked them into clicking it,” Catherine Connolly, a professor of organizational behaviour at McMaster University, told CBC News Thursday.
A copy of the email obtained by CBC News — with the title June Holiday — said N.L. Health Services wanted to recognize the work of employees during the implementation of the CorCare digital health information system, and that employees could register for a day off by clicking a link.
It was what’s known as a phishing email, and this one was the employer actually testing its employees and their cybersecurity knowledge.
Unions representing health-care employees said the exercise was in poor taste and called for accountability.
CorCare was touted as a tool to streamline digital health records in Newfoundland and Labrador. The program is expected to cost $600 million over the next decade.
NLHS has apologized for sending out a phishing email that promised health-care workers a paid day off. (NLHS)Good phish, bad phish
In the hands of scammers or illegitimate operators, phishing emails are designed to manipulate victims into divulging sensitive information like passwords or user data using social engineering — deceptive messages from seemingly reputable sources.
Within organizations like health-care, phishing tests are simulated cyberattacks to teach people how to spot tactics that could open the doors to an attack.
Newfoundland and Labrador’s health authority has worked to improve security after the system became the subject of one of Canada’s largest ever cyberattacks on a health-care network in October 2021 — caused by a compromised login credential.
While Connolly said the initiative to teach people about phishing emails is great on paper, she believes it was mismanaged in this case.
Newfoundland and Labrador faced what was called one of Canada’s largest cyberattacks in history in October 2021. (Paul Daly/CBC)
“If there was a good relationship with the organization already, if people already felt respected and [then] this happened, they might even have laughed it off,” she said, adding she believes employees should be well-trained to spot fraudulent emails.
“My guess is they’re kind of joking now. Like, ‘Of course we should have known that our employer would not do something so nice. That’s how we would have known that’s it’s fake.'”
CEO issues apology
N.L. Health Services interim CEO Ron Johnson apologized to employees for the exercise on Wednesday.
“The scenario used in this exercise was in poor taste and disrespectful to the people who work so hard every day to provide care and services,” Johnson said in an email, obtained by CBC News.
“Cybersecurity awareness remains important to protecting our patients, our information, and our health system. However, these efforts must be delivered in a way that reflects the respect, professionalism, and the care we provide to people.”
An investigation into the email is underway, Johnson said on Wednesday, as he said it’s unclear who approved or sent the email.
Any kind of test is dishonest, expert says
Jonathan Anderson, an associate professor of electrical and computer engineering at Memorial University, told CBC News that how phishing tests are administered plays a key role in how they’re received.
Different organizations operate tests differently, he said, but questions like how realistic the test is should be asked.
“The more you borrow from the real scammer’s playbook, the more realistic the test is going to be,” Anderson said Thursday.
“But on the other hand, scammers are, of course, unethical people. So the more you borrow from your playbook, the more unethical you are behaving as well.”
WATCH | Phishing tests used by organizations to spread cybersecurity awareness:
Ethics should be considered in conducting cybersecurity tests, expert says
The CEO of the province’s health authority is apologizing in the wake of backlash over a cybersecurity testing email that made a false promise of a day off. But as CBC’s Abby Cole reports, some experts say considerations should have been made before the email was sent.
Unions representing workers in the health-care system said the implementation of CorCare exhausted staff. It came with constant troubleshooting, mandatory overtime, cases of denied leave and some workers ultimately opting to quit.
Connolly said that while scammers work to capitalize on emotions, stress and how busy unsuspecting people can be, she believes the health authority might have taken the test a step too far.
“It’s almost a little too realistic. A little bit on the nose. So I can see why people would feel especially betrayed,” she said.
Download our free CBC News app to sign up for push alerts for CBC Newfoundland and Labrador. Sign up for our daily headlines newsletter here. Click here to visit our landing page.