Ontario’s health minister is ordering a provincial agency to immediately inform up to 200,000 patients whose data may have been breached in a spring cyber attack.
The patients who receive palliative and home care from the province had not been told their data may have been breached, despite the agency responsible knowing since at least May 30.
On Friday, Ontario Premier Doug Ford, Health Minister Sylvia Jones and the Information and Privacy Commissioner (IPC) all confirmed that the data of patients using the Ontario Health atHome service may have been breached.
In a letter to Ontario Liberal MPP Adil Shamji, who first flagged the cyber attack, the IPC suggested he was correct when he said the incident occurred more than three months ago in March.
The IPC commissioner confirmed to Shamji that a report had been filed “that aligns with the circumstances and date described in your letter.” Shamji had said the breach happened on or around March 17 and involved 200,000 patients.
A spokesperson for the IPC told Global News the watchdog had received reports of a breach from Ontario Health atHome. The government didn’t confirm the breach until June 27, after questions at an unrelated news conference.
“Ontario Health atHome notified our office of a privacy breach on May 30, 2025,” the spokesperson wrote. “At this stage, we are reviewing the circumstances of the incident and cannot share further details at this time.”
A spokesperson for Jones said the provincial agency had failed to tell her office about the breach or to inform patients who could be impacted.
“Our government expects all service providers to uphold the highest standards of patient care, security and confidence,” they said in a written statement.
“This includes taking immediate steps to identify when there has been a cyber breach and to notify the Ministry of Health immediately. The fact that this process was not followed is unacceptable.”
The Ministry of Health added it had told Ontario Health atHome to work with its vendor “to immediately notify impacted patients and to take steps with each vendor to ensure this never happens again.”
Ontario Health atHome said the issue was a “system outage” with Ontario Medical Supply, one of its vendors. The agency confirmed personal data had been impacted.
“Following an investigation by OMS into their system outage, OMS notified Ontario Health atHome that their outage was a cybersecurity attack and health information had been breached — information breached potentially includes name, contact information and medical supplies or equipment ordered,” Ontario Health atHome said.
With the breach potentially occurring in March and the IPC notified last month, it is unclear why patients involved have not yet been notified. Shamji said they should have been told long ago.
“I fundamental tenet of a breach of this nature — especially involving so many people — is to immediately notify those individuals,” he said. “They need to know that their personal information may be compromised and that they need to be monitoring things like credit scores.”
Ford appeared to suggest his office had not been informed, despite Ontario Health atHome telling the IPC about the breach a month earlier.
“We’ll find out where the gap is and why it wasn’t brought to our attention a lot earlier, but we’re glad the investigation is happening,” Ford said on Friday.
Global News sent questions to Ontario Health but did not receive a response ahead of publication.
The data breach is the latest issue in a difficult period for Ontario Health atHome, a rebranded and consolidated agency launched by the Ford government.
Supply shortages in the fall left more than 350 people receiving home and palliative care across the province without the medication or equipment they needed.
Delays in delivering supplies came after the government signed new contracts with private vendors for Ontario Health. As a result of the delays, the province had to refund $219,000 to people forced to buy their own medical supplies.
Shamji said the data breach was evidence of an agency which couldn’t function properly.
“Ontario Health atHome has been in disarray for months,” he said. “First with medication shortages and then with supply shortages, then with massive delays in care and now with the protection of personal health information. They’ve failed on all those things.”