![\"Nicole](\"https:\/\/www.newsbeep.com\/ca\/wp-content\/uploads\/2025\/08\/nicole-buffie-mug.jpg\")
<\/p>\nThe Manitoba ombudsman is criticizing the families department\u2019s service provider and security policies after data involving vulnerable Manitobans was accessed in a 2024 cyberattack.<\/p>\n
A report by the ombudsman\u2019s office, released May 28, revealed 1,361 clients of Community Living disABILITY Services may have had their personal and health information stolen when a third-party provider was hacked on Oct. 8, 2024.<\/p>\n
Community Living disABILITY Services supports eligible adults with intellectual disabilities.<\/p>\n
The intrusion was detected and the families department was notified the next day. The source of the hack was not disclosed in the report.<\/p>\n
The name of the service provider and the work it was doing for the families department were not disclosed, but the document notes it is a non-profit organization.<\/p>\n
After the incident, the service provider in question implemented several security measures, the report states.<\/p>\n
Following an investigation, the ombudsman\u2019s office found the families department did not have specific security and audit policies for service providers to ensure personal information is stored securely.<\/p>\n
\u201cWhen Manitobans receive services through government programs and entrust their highly sensitive (personal information) and (personal health information) to a public body or trustee, they also rely on that public body or trustee to protect their information,\u201d the report states.<\/p>\n
The report also criticized the department for its tardy alert to potential victims, saying it did not notify affected clients and caregivers until Nov. 24, 2024.<\/p>\n
While the department attributed the delay to an ongoing investigation into the hack and a Canada Post strike, which began Nov. 15 that year, the report says a warning should have gone out sooner through an indirect channel (such as a public notification) or the media \u2014 given the \u201cacute sensitivity\u201d of the information involved.<\/p>\n
\u201cAn earlier notification would have allowed individuals and their caregivers to take protective steps at an earlier stage, including monitoring financial accounts and taking steps to secure their (social insurance numbers) and (personal health identification numbers),\u201d the report states.<\/p>\n
In its investigation, the ombudsman\u2019s office found the families department relied on wording in its contract with the service provider as the mechanism for ensuring that organization adopted security safeguards. The department did not conduct any audits to make sure the company was protecting client data and didn\u2019t have\u00a0specific\u00a0policy or guidelines on security requirements for vendors.<\/p>\n
The families department told investigators it provided \u201cguidance\u201d to its service providers on privacy and security matters in 2022, and again in 2025.<\/p>\n
However, the guidelines were general privacy awareness presentations and not specific enough for the work being done, the report says. \u201cThe absence of vendor and service provider management policies and security control guidelines has significant implications for families\u2019 ability to fulfil its obligations under (legislation).\u201d<\/p>\n
The report issued five recommendations, which the families department formally accepted last week and has 60 days to\u00a0submit an implementation plan on, including: develop and communicate minimum standards for the protection of personal and health information; enforce framework for managing the cybersecurity risks associated with third-party service providers; review and update current contracts with updated privacy and cybersecurity expectations; develop and enforce an audit and oversight process for service providers handling personal information; and follow up with the service provider involved in the hack to ensure it implements security and safety mechanisms.<\/p>\n
On Tuesday, Families Minister Nahanni Fontaine told the Free Press the department is working to implement the recommendations. She added cyberattacks are the new reality for government departments and organizations.<\/p>\n
Since the 2024 hack, no privacy breaches have been reported as a result of cybersecurity incidents, a provincial spokesperson said.<\/p>\n
The ombudsman\u2019s office did not respond to queries about the investigation.<\/p>\n
nicole.buffie@freepress.mb.ca<\/p>\n
\t\t\t\t<\/p>\n
Nicole Buffie Nicole Buffie is a reporter for the Free Press city desk. Born and bred in Winnipeg, Nicole graduated from Red River College\u2019s Creative Communications program in 2020 and worked as a reporter throughout Manitoba before joining the Free Press newsroom as a multimedia producer in 2023. Read more about Nicole<\/a>.<\/p>\n Every piece of reporting Nicole produces is reviewed by an editing team before it is posted online or published in print \u2014 part of the Free Press\u2018s tradition, since 1872, of producing reliable independent journalism. Read more about Free Press\u2019s history and mandate<\/a>, and learn how our newsroom operates<\/a>.<\/p>\n
Multimedia producer
\n\t\t\t\t\t\t\t\t\t<\/a>
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/a>
\n\t\t\t\t\t\t\t\t\t\t\t\t\t<\/a>\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/p>\n