The Ontario MPP who brought to light a massive data breach at a provincial agency is calling on the minister of health to say when she learned about the cyber incident and explain why it appears to have taken months to inform patients.

On Friday, Liberal MPP Adil Shamji published a letter from the information and privacy commissioner, which indicated the data of some 200,000 patients using Ontario Health atHome had been compromised in March.

Until that point, the provincial agency — which handles home and palliative care — had not informed patients that their data could be accessed.

After the data breach came to light Friday, Minister of Health Sylvia Jones’ office said she had “ordered” Ontario Health atHome to contact patients. The agency’s website now includes an update on the breach, along with a phone number and email.

“Following an investigation by OMS, they notified Ontario Health atHome that the outage was a cybersecurity attack and health information had been breached,” part of the update reads.

Get weekly health news

Receive the latest medical news and health information delivered to you every Sunday.

“The information breached potentially includes name, contact information and medical supplies or equipment ordered.”

The information published by Shamji suggests the breach itself occurred “on or around” March 17, a date the IPC appeared to confirm Friday. Ontario Health atHome informed the privacy watchdog that the breach had taken place more than a month later, on May 30.

Patients were not informed that their data may have been breached until after Shamji’s announcement on Friday.

“What excuses ios there for such a profound delay in notification? Why has the government done so little to act on this massive privacy breach?” Shamji said on Wednesday.

“But most important of all, when in the long three and a half months after the data breach occurred did the minister of health find out?”

Global News contacted Jones’ office to ask when she had learned about the breach, but did not receive a response ahead of publication.

On Friday, her office suggested she had only recently been informed.

“Our government expects all service providers to uphold the highest standards of patient care, security and confidence,” a spokesperson said in a statement.

“This includes taking immediate steps to identify when there has been a cyber breach and to notify the Ministry of Health immediately. The fact that this process was not followed is unacceptable.”

At an event on Friday, Ontario Premier Doug Ford also suggested he had not been informed, despite Ontario Health atHome telling the IPC about the breach a month earlier.

“We’ll find out where the gap is and why it wasn’t brought to our attention a lot earlier, but we’re glad the investigation is happening,” Ford said on Friday.

&copy 2025 Global News, a division of Corus Entertainment Inc.