Ontario Medical Supply ransomware attack affected an estimated 200,000 patients
Summary
Internal reports show ransomware accessed Ontario Medical Supply systems on March 17, 2025, and triggered its payload April 13. An estimated 200,000 patients’ data was affected; OMS said limited, incomplete data was exfiltrated, with no evidence of misuse.
Key points
- Internal reports and emails obtained by Global News indicate ransomware first accessed OMS systems on March 17, 2025; its payload was triggered on April 13.
- OMS systems failed on April 14, and Ontario Health atHome was informed of the incident.
- The incident was estimated to affect about 200,000 patients, with information including names, contact details, and medical supplies or equipment ordered.
- OMS said a limited amount of incomplete data was exfiltrated and stated there was no evidence that personal financial information or critical health data was taken or that information had been misused.
- Ontario Health atHome was ordered to inform patients after an MPP publicly raised the incident in June 2025; the article reports patients were not immediately notified.
- The Ministry of Health said no ransom was demanded from the province or Ontario Health atHome.
Article Details
- Victim Organization
- Ontario Medical Supply (OMS)
- Incident Type
- Ransomware attack that locked servers and resulted in a breach of patient information.
- Incident Date
- 2025-03-17
- Disclosure Date
- 2025-06-27
- Data Types Exposed
- Names
- Contact information
- Medical supplies or equipment ordered
- Affected Records
- An estimated 200,000 patients were impacted; the article does not establish that this many records were exfiltrated.
- Operational Impact
- A significant portion of OMS servers was locked, and its systems failed. The ransomware payload was triggered on April 13, 2025. OMS reportedly experienced weeks of internal confusion about what data had been compromised.
- Ransom Or Extortion
- The Ministry of Health said no ransom was demanded from either the province or Ontario Health atHome. OMS said a limited amount of incomplete data was exfiltrated and that there was no evidence of misuse.
- Claim Status
- confirmed