OPP arrest government employee following security breach of Ontario vaccine system

Multiple arrests have been made following a cybersecurity breach of Ontario’s COVID-19 vaccine system.

The Ontario Provincial Police say they have arrested two suspects in relation to the data breach, one of whom was a provincial government employee.

CityNews learned last week that the Ford government was investigating the potential breach after they received reports that spam text messages were being sent out to some Ontarians who booked vaccination appointments through the system or accessed their proof of vaccination QR code.

NDP Leader Andrea Horwath asked about the alleged hack in Queen’s Park on Wednesday.

“The only reason we even know about it is because those people whose information was breached actually went to the media,” said Horwath. “Who will take responsibility for this cover up?”

In response, House Leader Paul Calandra said the government worked quickly to resolve the issue.

“The OPP was immediately engaged and quickly went to work and has charged an individual who is no longer working for the government,” said Calandra.

A spokesperson for the Solicitor General says the OPP investigation confirmed that no personal health information was accessed, but police tell CityNews they cannot confirm that.

“Following a swift and thorough investigation, which included both internal and external experts, the OPP has charged an individual who worked through a third party vendor in the vaccine booking call centre, but is no longer employed by the government,” reads a statement from the Solicitor General.

“Ontario’s COVID-19 vaccine booking system remains secure and continues to be a safe tool for Ontarians to use.”

Police arrested 21-year-old Ayoub Sayid of Gloucester, Ont. on Monday. Sayid worked in a vaccine booking call centre and is a former employee of the Ministry of Government and Consumer Services.

They also arrested 22-year-old Rahim Abdu from Quebec.

Both were charged with Unauthorized Use of a Computer contrary to s. 342.1(1)(c) of the Criminal Code. They have since been released from custody and will be schedule to appear in court.

Police executed search warrants this week after being asked by the province to investigate the breach on Nov. 17.

The government said last week that a small number of individuals who use the system have received the scam messages, which reportedly ask for financial information.

The OPP say they are still trying to determine how many people may have received one of these messages and exactly what type of information may have been asked for.

Two callers to the CityNews newsroom say they received messages shortly after using the system. Both said the texts asked them to respond to receive a sum of money through email transfer.

“I had my third dose recently, I updated my QR code, and it was immediately following that I got the text,” said Philippa Hetherington.

The province’s online COVID-19 vaccine portal first launched in March 2021.