Cybersecurity incident: Important information for CarePoint Health patients
CarePoint Health is providing its patients with important information about a cyber incident it has been responding to since earlier this month.
What happened
We first became aware of the incident on March 19, 2026, when we received contact from a threat actor claiming unauthorized access to our network and data. We immediately engaged experts and activated our incident response processes.
While indications were initially unclear, data theft has now been confirmed. We have now discovered and analyzed evidence of the set of stolen files. Unfortunately, the stolen files include information about a number of clients.
Privacy notification
Based on our analysis to date, we are notifying our clients of the following exposure.
| Groups with patients who are likely affected | Information exposed includes |
|---|---|
| Patients in our COVID@Home monitoring program that received services from August 2021 to December 2022** | Full name, address, phone, health card number, date of birth, and assessment information |
| Patients who received Emotion Focused Group Psychotherapy or were waitlisted for the group from 2022-2025 | Full name, age, information about service received, and assessment information |
| Patients in our Structured Psychotherapy (OSP) programs who received services from 2022 to present | Full name, information about service(s) received, assessment information, clinical plan information |
| Patients who received services at CarePoint Health from April 2025- Jan 2026 and completed a socio-demographic intake form** | Full name, socio-demographic information |
| Patients who received spirometry services at CarePoint Health between 2023-2025 | Full name, information about service received, assessment information |
| Patients in our Memory Clinic program that received services between 2019-2025** | Full name, date of birth, and information about service received |
| Patients in our CPH Connects Program, Supportive Care Program**, Smoking Cessation Program, Diabetes Workshop**, and Diabetes Program and Nursing Services at CarePoint Health from 2022-2025 | Full name, address, phone, health card number, date of birth, and information about service received |
*Please note that the amount of information exposed varies by individuals. Not all individuals have had each listed data element exposed.
** This information was contained only in encrypted and password protected files. We are treating it as exposed out of caution.
We will notify a small number of affected patients by email or mail directly, within the week. If you do not receive a direct notification from us, we have not determined that you are affected by this incident unless you are listed in the groups above.
We have reported this matter to law enforcement and the Information and Privacy Commissioner of Ontario. You can learn about your entitlement to complain at http://www.ipc.on.ca, though we have reported this incident to the IPC and give it our full cooperation.
What this means to affected patients
To be cautious, you should always watch for the following.
- Messages that say they are from CarePoint Health when you weren’t expecting them.
- Anyone asking you for personal or health information (like your address, date of birth, OHIP number, Social Insurance Number, or banking details).
- Emails, texts, or calls that sound urgent or pressure you to act fast.
- Links or attachments you did not ask for or did not expect.
- Names, phone numbers, or email addresses that don’t look right or feel different from usual.
- Websites that look odd or don’t match the normal CarePoint Health website.
We also invite you to contact us at the email below, should you have any reason to believe your CarePoint Health information has been misused.
What we are doing
We are sincerely sorry that this incident occurred and for the concern it may cause. Our organization was targeted by criminal actors whose actions run directly contrary to our values and the trust our community places in us. While we are deeply disappointed that this criminal activity has affected our patients, we want to be clear that we are responding decisively - working to secure our systems, protect information, and support law enforcement and other authorities in holding those responsible accountable.
If you have any questions about this notice, please contact
privacy@carepointhealth.ca
