Lakelands Public Health Provides Notice of Cybersecurity Incident

(June 30, 2026) – On January 29, 2026, Lakelands Public Health (formed through the merger of the 
Haliburton, Kawartha, Pine Ridge District Health Unit and Peterborough Public Health) discovered a 
cybersecurity incident affecting the Peterborough Office location IT server only. In compliance with 
provincial legislation, and out of an abundance of caution and respect for client privacy, Lakelands 
Public Health is issuing this communication to inform the public of this matter and has also reported 
the incident to the Information and Privacy Commissioner of Ontario (IPC).

An unauthorized third party (threat actor) gained remote access to a limited portion of our network 
environment. As part of the incident, the threat actor accessed, extracted, and encrypted, files 
containing personal information and personal health information from our servers. All files were 
successfully restored from backups.

Following a detailed investigation, it was determined that approximately 60,000 current or former 
residents of Peterborough County and the City of Peterborough may have been affected. This includes 
individuals who received services from Lakelands Public Health or whose health-related information 
(such as laboratory results) was received by the organization from 1996 up to January 2026.

Immediately after discovering the incident, we engaged external cybersecurity experts to contain the 
threat, investigate the scope of the incident, and strengthen our systems and security measures. At 
this time through continuous monitoring and expert-input, there is no evidence that the information 
involved has been misused for fraudulent purposes or published online.

About Lakelands Public Health 
Lakelands Public Health provides public health programs, clinical services, and health and wellness 
support to individuals and families throughout our communities. As part of delivering these services, 
we collect and maintain personal and personal health information, including medical records, 
laboratory results, and other health-related information.

What Happened?
On January 29, 2026, Lakelands Public Health identified suspicious activity within a portion of our 
network after certain systems became inaccessible. We immediately took steps to:
• Isolate affected systems
• Contain the incident
• Launch an investigation with third-party cybersecurity experts
• Notify law enforcement
• Strengthen network security measures

Our investigation determined that an unauthorized third party accessed data and extracted certain 
records containing personal information and personal health information, including some active and 
historical client records. As mentioned previously, all files were successfully restored from backups.

Who May Be Affected?
You may be affected if you:
• Were a client of the Peterborough location of Lakelands Public Health between 1996 to 
January 2026.

What Information May Have Been Involved?
The information involved may include some combination of the following:
• Name
• Date of birth
• Home address
• Telephone number
• OHIP number
• Medical diagnosis
• Medication information
• Treatment information
• OHIP billing codes
• Dates of service
• Vaccination information
• Healthcare provider information

Please note that not every individual had all categories of information affected. The type of 
information involved varies depending on the services received. At this time, there is no evidence that 
any information involved in this incident has been used for identity theft or fraud.

What We Are Doing
Protecting personal information and personal health information in our care remains a top priority.
Since discovering the incident, Lakelands Public Health has:
• Engaged leading cybersecurity experts
• Contained and secured affected systems
• Conducted a comprehensive forensic investigation
• Reported the incident to law enforcement
• Notified the Information and Privacy Commissioner of Ontario (IPC)
• Enhanced cybersecurity protections and monitoring

We continue to monitor for any signs that the information involved has been misused or disclosed 
online. If future developments arise, updates will be posted on our website.

What You Can Do
Currently, no additional action is required. Based on the findings of cybersecurity experts, the risk of 
identity theft or fraud related to this incident is considered low. Remain vigilant by:
• Monitoring personal accounts and statements
• Reporting suspicious activity to service providers or law enforcement
• Being cautious of unsolicited communications requesting personal information

Lakelands Public Health will never contact you by email or text message asking you to provide 
sensitive personal information.

Your Privacy Rights
You have the right to file a complaint with the Information and Privacy Commissioner of Ontario (IPC).

Information and Privacy Commissioner of Ontario
1400 – 2 Bloor Street East, Toronto, Ontario M4W 1A8
Telephone: 416-325-7539 | Email: info@ipc.on.ca
You can also complete a complaint form through the IPC website.

Contact Us
If you have questions about this incident or require additional information, please contact us:
Phone: 249-588-0044 | Hours: Monday to Friday, 8:30-4:30 p.m.

-30-