Five Canadian hospitals have confirmed that patient and employee data that was stolen in a ransomware attack has been leaked online.

The data breach impacts Bluewater Health, Chatham-Kent Health Alliance, Erie Shores HealthCare, Hôtel-Dieu Grace Healthcare, and Windsor Regional Hospital, along with service provider TransForm Shared Service Organization. A shared drive was compromised as part of the incident.

On Monday, Bluewater Health said that a patient database report that included “approximately 5.6 million patient visits made by approximately 267,000 unique patients” was stolen, along with some employee data, from the shared drive.

The organization is now working on identifying the impacted individuals and is also investigating the type of employee information that was compromised.

The shared drive contained information pertaining to 1,446 individuals employed by Chatham-Kent Health Alliance as of February 2, 2021, including their names, addresses, gender, dates of birth, marital statuses, social insurance numbers, and basic pay rates.

The information of some Erie Shores HealthCare patients was also stolen in the attack, along with “approximately 352 current and past employee social insurance numbers”.

For Windsor Regional Hospital and Hôtel-Dieu Grace Healthcare, limited patient and employee information was accessed, but no medical records or social insurance numbers.

No banking information was stolen in the attack, the hospitals said.

“All hospitals have some degree of patient and employee information affected. All of our hospitals are diligently investigating the stolen data to determine who is impacted. […] The teams continue to work around the clock to restore systems,” Bluewater Health said, noting that the Ontario Information and Privacy Commissioner has been notified of the incident.

While the organization did not name the threat actor behind the attack, the Daixin ransomware gang has claimed responsibility for the incident and has posted online data allegedly stolen from the five hospitals.

The group claims to have exfiltrated more than 160 GB of data, including thousands of personally identifiable information (PII) and protected health information (PHI) records.

In October last year, the US cybersecurity agency CISA and the FBI warned healthcare organizations of the risk associated with the Daixin ransomware.

Related: CISA, HHS Release Cybersecurity Healthcare Toolkit

Related: Healthcare Organizations Hit by Cyberattacks Last Year Reported Big Impact, Costs

Related: 3.3 Million Impacted by Ransomware Attack at California Healthcare Provider