Skip to content

Notice of Cybersecurity Incident

October 27, 2025

On July 5, 2024, the Information and Privacy Commissioner of Ontario (“IPC”) issued CYFSA Decision 19 (the “Decision”) under the Child, Youth and Family Services Act, 2017. The Decision was subsequently appealed and, along with a concurrent decision issued to an Ontario hospital, judicially reviewed. On September 16, 2025, the Divisional Court dismissed those proceedings and upheld the Decision.

Family and Children’s Services of Lanark, Leeds and Grenville (“FCSLLG”, “we”) is notifying individuals that on February 5, 2022, we detected suspicious activity on our network and took immediate action. This cybersecurity incident resulted in certain personal information stored on our network being temporarily inaccessible. A comprehensive third-party investigation into the matter uncovered no evidence that any personal information in our care was viewed, accessed, stolen or permanently corrupted.

The investigation determined the unauthorized third party deployed malware which encrypted certain FCSLLG computer systems at the “container level”, meaning any files containing personal information on those systems were not themselves encrypted or otherwise interacted with. As a result of this, FCSLLG was unable to access those files for a short period of time (two weeks) while the systems were recovered from backup copies. In the absence of any evidence to indicate that personal information we hold was accessed, taken or otherwise interacted with, we consider the risk of harm stemming from this incident to be very low and are notifying you about the incident out of an abundance of caution and in accordance with the Decision noted above.

Further, upon discovering the incident, FCSLLG took the following actions:

  • Immediately engaged a third-party cybersecurity specialist to conduct a comprehensive investigation into this incident.
  • Promptly informed the IPC and reported the event to law enforcement.
  • Implemented all necessary and corrective measures to better prevent against an incident of this nature from occurring.

We take our privacy obligations very seriously and regret any concern this incident may cause the community we serve.

If you have any questions regarding this incident, please contact Cindy Morrow, Privacy Lead, at fcsllgprivacylead@fcsllg.ca.

Should you wish to file a complaint with the IPC, please visit https://www.ipc.on.ca.en. While you are entitled to file a complaint with the IPC, the IPC has already looked into this matter.