On July 5, 2024, the Information and Privacy Commissioner of Ontario (“IPC”) issued CYFSA Decision 19 (the “Decision”) under the Child, Youth and Family Services Act, 2017. The Decision was subsequently appealed and, along with a concurrent decision issued to an Ontario hospital, judicially reviewed. On September 16, 2025, the Divisional Court dismissed those proceedings and determined the Decision should stand.
The Halton Children’s Aid Society (“Halton CAS”, “we”) is informing individuals that on February 22, 2022, we detected suspicious activity on our network and immediately took action. This cybersecurity incident resulted in certain personal information contained on our network being temporarily inaccessible. A comprehensive third-party investigation into the matter uncovered no evidence that any personal information in our care was viewed, accessed, stolen or permanently corrupted. This finding has also been accepted by the IPC.
Rather, an unauthorized third party deployed malware which encrypted certain of Halton CAS’ computer systems at the “container level”, meaning any files containing personal information on those systems were not themselves encrypted or otherwise interacted with. As a result of this, Halton CAS was unable to access those files for a period of time (one week) while the systems were recovered from backup copies. In the absence of any evidence to indicate that personal information we hold was accessed, taken or otherwise interacted with, we consider the risk of harm stemming from this incident to be very low.
In response to this incident Halton CAS took the following actions:
- Immediately engaged a third-party cybersecurity specialist to conduct a comprehensive investigation into this incident.
- Promptly informed the IPC and reported the event to law enforcement.
- Implemented all necessary and corrective measures to better prevent against an incident of this nature from occurring.
We take our privacy obligations very seriously and regret any concern this incident may cause the community we serve.
If you have any questions regarding this incident, please contact Teresa Zonneveld at PrivacyLead@haltoncas.ca.
Should you wish to file a complaint with the IPC, please visit https://www.ipc.on.ca.