Southern Manitoba child welfare authority back online following ransomware attack

The child welfare authority responsiblefor 5,000 First Nations foster children in southern Manitoba has regained access to its internal IT system after a ransomware attack left the system completely unusable for more than six weeks.

Answering questions through a Toronto-based lawyer, the Southern First Nations Network of Care said the computer system has beenback up and running since sometime in January, following a November ransomware attack.

"With the exception of some past emails that have not been restored, the system is no longer impacted by the ransomware attack," lawyer Mouna Hanna, who specializes in cyber- and privacy breaches,said in an email.

The Southern First Nations Network of Care provides an internal IT network to eight of the 10 child welfareagencies it oversees. The network is used for everything from emailing about foster cases to tracking financial information.

The ransomware attack, which happened on Nov.21,left that system completely paralyzed, meaning all employees on the system were unable to use their computers or access emails.

There was no evidence any personal or health information was taken from the system as a result of the attack, Hanna said.

Won't talk about precautions

The southern authority's lawyer would not answer questions about what, if any, extra measures the care network has taken to preventsimilar incidents from happening in the future.

Manitoba RCMP's major crimes unit had launched a criminalinvestigation, butRCMPareno longer investigating the complaint, spokesperson Paul Manaigre said Thursday.

At the time of the attack, police said they believedthe cyberattackoriginated in Headingley, Man., which isalso where the main offices of Southern First Nations Network of Care are.

An unnamed forensic security firm headquartered outside Winnipeg has been leading the southern authority's own investigation, its lawyer previously told CBC News.

The firm was hired even though the province offered its experts to help get the system back online.

A spokesperson for the provincial government confirmedit isno longer providing additional help to the southern authority now that the computer system is back up and running.

Authority 'dysfunctional': Sandy Bay CFS head

The child care authorityhas beenunder fire from parents, former employeesand its own member child welfare agencies following the attack.

Last month, the authority's former senior policy advisor went public, saying he warned of the potential for a cyberattack, and told both the authority and the province that the safety of kids was threatened by mismanagement at the Southern First Nations Network of Care.

In November, CBC Newsspoke to the head of Sandy Bay Child and Family Services, one of the agencies overseen bythe southern authority, who said the care network was "dysfunctional" and had published information on its website that made it vulnerable to the cyberattack.Sandy Bay CFSwas not affected by the ransomware because it's on a separate IT network.

Both the former employee and the Sandy Bay agency's executive director called on the province to take a closer look at the Southern First Nations Network'sboard of directors and appoint an outside administrator.

In January, Families Minister Heather Stefanson said putting the southern authority under third-party management was not under consideration at that time.

Have a story or tip related to this topic? Email Marina von Stackelberg.