At Stonehenge Therapeutic Community (STC), we take privacy and the security of personal information and personal health information in our care seriously. The purpose of this notice is to inform you that we experienced a cybersecurity incident that may have involved your personal health information. Please read this notice carefully.
What Happened?
On April 28, 2026, we discovered that an unauthorized third-party had accessed our IT systems and encrypted (i.e., locked or otherwise blocked our access to) some of our servers where we store our files. As soon as we became aware of this, we immediately took action to contain the incident and secure our systems. We also brought in cybersecurity experts to help us investigate what happened, determine what was accessed and whether any sensitive information was affected. The investigation has confirmed that some files were taken from our systems.
What Information Was Involved?
We keep our clients’ personal health information in an electronic medical records database, and based on the investigation, there is no indication that the unauthorized third-party accessed or took any files from this database. However, the unauthorized third-party was able to encrypt this electronic medical records database, which means that we were temporarily blocked from accessing our client’s medical records. The types of personal health information contained on our electronic medical records database varies for each client, but would typically include some or all of the following: name, date of birth, address, clinical notes, medications.
For a very limited number of clients, your name may have been contained in some files that were access or taken by the unauthorized party (e.g., consent forms).
While we appreciate you may have concerns about this incident, we consider your exposure to potential harm stemming from this incident limited.
What Has Been Done?
We have worked closely with our IT service provider over the years to protect our IT systems. However, cyber threats are always evolving, and these kinds of incidents are not always preventable. Since discovering this incident, we have worked with cybersecurity experts to improve our security and help prevent something like this from happening again. We have confidence in the measures we have taken to counter this incident and believe our systems are now safe. We are actively monitoring our systems to help protect against future threats. Keeping your information safe is very important to us.
We have reported this matter to the Information and Privacy Commissioner of Ontario (IPC). You do not need to take any further steps. You have the right to file a complaint with the IPC at https://www.ipc.on.ca/en/resources/forms/file-health-information-privacy-complaint. We have also reported this matter to the police.
What Can You Do?
While we have no evidence that your information has been misused for any fraudulent purposes, we encourage you to be careful and watch out for common threats to your identity and personal information. Here are some steps you can take to protect yourself:
- Be careful when sharing your personal or health information, especially when the request is unexpected. If someone contacts you and asks you for your personal information out of the blue, do not share it.
- Do not click on links or download attachments in suspicious emails.
- If you receive a message that looks like it is from us asking for money or other personal information, and you were not expecting it, it may be a scam. Contact us directly to confirm before responding to the message.
For More Information
If you have questions about this notice, you can contact Rebecca Webb at privacy@stonehengetc.com and we will respond to your inquiry as quickly as we are able to.
We sincerely regret that this incident has occurred and assure you we are taking it very seriously.
Thank you for your patience and understanding.
For more information see our Client Notification FAQ
