Ontario Health atHome has disclosed that approximately 200,000 home care patients had their personal and medical information compromised following a ransomware attack on Ontario Medical Supply (OMS), a third-party vendor responsible for delivering medical supplies and equipment to patients across the province. The breach, which occurred between March and April 2025, was not publicly disclosed until June 2025, sparking intense criticism over the delayed notification.
What Happened
Threat actors infiltrated the systems of Ontario Medical Supply during March 2025, establishing persistence within the network over several weeks. On April 13, 2025, the attackers triggered the ransomware payload, encrypting OMS systems and exfiltrating patient data. OMS reportedly paid the ransom to regain access to its systems and obtain assurances that the stolen data would be deleted, though security experts caution that such promises from ransomware groups are unreliable.
Ontario Health atHome, which contracts with OMS to deliver medical supplies and equipment to patients receiving home care services, was notified of the breach shortly after the ransomware deployment. However, the organization did not begin alerting affected patients until June 2025, more than two months after the attack.
The Supply Chain Attack Vector
This incident highlights the critical risk posed by third-party vendors in the healthcare supply chain. OMS held sensitive patient data as part of its contractual obligation to fulfil medical supply orders for Ontario Health atHome. The data shared with OMS was necessary for supply delivery but created an extended attack surface beyond the direct control of Ontario Health atHome.
Healthcare organizations increasingly rely on networks of vendors, subcontractors, and technology providers, each representing a potential entry point for attackers. CyberSafe recommends that organizations implement rigorous third-party risk management programs, including regular security assessments of all vendors with access to sensitive data.
Patient Data at Risk
The compromised records of approximately 200,000 home care patients include:
- Full names and residential addresses
- Contact information including phone numbers and email addresses
- Medical supply and equipment order details
- Health card numbers in some cases
- Information about medical conditions related to equipment needs
Delayed Disclosure Controversy
The two-month gap between the attack and patient notification drew sharp criticism from privacy advocates, affected patients, and members of the Ontario legislature. Patients argued that the delay left them unaware and unable to take protective measures during a period when their data may have been actively exploited.
By March 2026, Ontario's opposition parties formally demanded that the provincial government explain why patients were not notified sooner and what steps were being taken to prevent similar delays in the future. The Ontario Information and Privacy Commissioner launched an investigation into the notification timeline and the adequacy of both OMS's and Ontario Health atHome's privacy practices.
What Affected Patients Should Do
- Monitor financial accounts and credit reports for signs of identity theft
- Be alert for phishing emails or calls referencing home care services or medical supplies
- Contact Ontario Health atHome's dedicated breach hotline for information about your specific data exposure
- Report any suspicious activity to the Canadian Anti-Fraud Centre at 1-888-495-8501
- Consider placing a fraud alert with Equifax Canada and TransUnion Canada
Healthcare Cybersecurity Imperatives
The Ontario Health atHome breach reinforces several critical lessons for healthcare organizations and their vendors:
- Conduct thorough security assessments of all third-party vendors with access to patient data
- Require contractual security obligations including incident notification timelines from all vendors
- Implement data minimization practices, sharing only the minimum patient data necessary for service delivery
- Establish and regularly test incident response plans that account for supply chain compromises
- Deploy network monitoring and endpoint detection solutions that can identify lateral movement and data exfiltration
- Ensure compliance with PHIPA and federal privacy legislation regarding breach notification timelines with help from cybersecurity consulting services
Frequently asked questions
What happened in the Ontario Health atHome ransomware breach?
Ontario Medical Supply, a third-party vendor delivering medical supplies for Ontario Health atHome, was hit by ransomware. Attackers entered its systems in March 2025 and triggered the ransomware on April 13, 2025, exfiltrating patient data. The breach was not publicly disclosed until June 2025, which drew criticism over delayed notification.
How many patients were affected by the Ontario Health atHome breach?
Approximately 200,000 home care patients had personal and medical information compromised. The records include names and addresses, phone numbers and email addresses, medical supply and equipment order details, health card numbers in some cases, and information about medical conditions related to equipment needs. The Ontario Information and Privacy Commissioner launched an investigation.
What should affected patients do after the Ontario Health atHome breach?
The article recommends monitoring financial accounts and credit reports for identity theft and watching for phishing emails or calls referencing home care services or medical supplies. Patients can contact Ontario Health atHome's dedicated breach hotline about their exposure, report suspicious activity to the Canadian Anti-Fraud Centre, and consider fraud alerts with Equifax Canada and TransUnion Canada.