The Current - What's driving "The Denial Machine" at B.C. Interior Health?

Episode Date: October 10, 2025

Imagine having your data stolen at your work, and your most sensitive information ending up for sale on the dark web. A Fifth Estate investigation reveals that's what happened to thousands of employees at B.C.'s Interior Health. A data breach has exposed the information of healthcare workers, leaving some to have their identity stolen repeatedly, while the agency denies the breach ever happened.

Okay, I know, I know it's not time for the holidays, but can we talk about Mariah Carey for a second? She just dropped her first full album in seven years. We're going to talk about that on Commotion, but also we're going to celebrate 20 years as her iconic record, The Emancipation of Mimi. For this episode and a whole lot more, you can find and follow Commotion with me, Alameen Abdul Mahmood, on YouTube or wherever you get your podcast. This is a CBC podcast. Hello, I'm Matt Galloway, and this is the current podcast. Imagine having your data and identity stolen and having it end up for sale through the dark web. Imagine that data breach happened at your work.

That is what happened to Kathleen Reimer. I think they should pay for what they've done. Like, it was brutal. Like, I almost got turned down for buying a house because my credit was so bad. Kathleen Reimer is one of thousands of health care workers who had their sensitive information stolen in a data breach at BC Interior Health. A new Fifth Estate investigation has found that the information has been sold online for years and for cheap. Fraudsters have been taking out credit cards, car loans, and filing bogus tax returns. And all the victims say they have been left to clean up

the mess on their own. Mark Kelly, as co-host of CBC's The Fifth Estate, he's been looking into the state of breach over the last year and he joins me in our Toronto studio. Mark, good morning. Good morning, Matt. These sorts of breaches happen all the time. You read about them all the time. where somebody's information is stolen and somebody ends up purchasing something under somebody else's name and it's not the purchase that they wanted. Why did you want to dig into this one,

this particular breach at BC Interior Health? Well, Matt, this is a bit of a mother load of all breaches. This was one that really attract our attention because it's involving tens of thousands of people. And what's shocking about this is so many of these people didn't even know that their names were part of a breach because there has been a playbook by BC's Interior Health Authority.

This is a government agency that oversees clinics, hospitals in the interior of the province. And they've had a playbook for 10 years. It's deny, deflect, and distract. And while this has been happening, people have been one by one starting to realize, hey, something's not right. And they started to speak out one at a time. And what we wanted to do is really amplify their voices and tell their story because there's been so much privacy around this.

People say, well, we can't talk about this because it's the privacy of people's personal information. Sure. Well, that information's out there now. And, you know, there's this adage that we have in investigative journalism that we like to shine a light in dark places. This was a dark place. It needed a lot of light, and that's what we've done. When you're shining the light, when did it start to become clear just how big this could possibly be? Our investigation goes back essentially to 2014.

And that's when there was pockets of victims coming forward in small, towns, Creston, Nelson, Colonna, Cranbrook. They didn't know about each other, though. They were saying, well, my identity is being stolen, credit cards being taken out, as you were mentioning before. And then there was a small town cop, an RCMP officer in the town of Trail, BC. He gets a couple of these identity theft cases on his desk. He starts looking and says, wait a minute, I see something in common here. All of these people are employees of BC's interior health. So then he starts opening, widening his search throughout the BC Interior. And the case grows and grows. He widens that search and then bingoes. Here's what he

found. At the end of it, I think I got up to either just shy of or just over 100 files. Every single one of them was an interior health employee, with the exception of one. But 99% of them interior health employees invariably. What did that suggest to you? It suggested to me that interior health had a data breach. That's the RCMP constable. It's named Stuart Ward. What did Stewart Ward do with that information that he found? Well, of course, he took that information to Interior Health. He said, he handed it over to them. I said, what you expect them to do?

He says, I wasn't sure. He says, I was looking at the criminality. Whatever they were going to do, I thought they would at least be informing their employees. That didn't happen. He also contacted the office of BC's Privacy Commissioner. I said, what do you expect they would do? He said, well, I thought if there's a data breach that's out there, that they're going to be talking to Interior Health, they're going to be launching an investigation.

Well, that never happened. And at that point, you know, Stewart Ward was really essentially sounding the alarm expecting somebody was going to be rushing to the rescue of these employees. That never happened. You now know from Stewart Ward that there are, what, 100 people potentially more who had their identity stolen, and almost all of them were working at BC Interior Health. Right. So, and then in 2017, another revelation. I mean, this story has so many layers to it, Matt. In 2017, another revelation. The RCMP turn up lists with 500 names and personal information of interior health employees. Social insurance numbers, birth dates, addresses. These are in the hands of bad guys. So what do you think here? Logically, it looks like there has been a data breach.

And yet, Interior Health goes out and they get an external consultant's report who says, we're taking a look at it. And it seems that there's no evidence. It's more than the 500 names that people have got their hands on. And they call this, quote, reassuring. And we wanted to see a copy of that report, of course, but Interior Health denied our request to see that. But it looks like the alarm bell should be going off. And yet the message that Interior Health is saying, nothing to see your folks move on.

I just, I don't know that I understand that. Why would Interior Health deny that there had been a data breach? Well, this is the key question, Matt. And, you know, it's hard for us to speculate. But let me fast forward to 2024. RCMP turn up a list with 20,000 names on it, including 7,000 names, personal information, social insurance numbers, et cetera, of current interior health employees. And yet, they don't even call that.

they find that a data breach, they call it, quote, an information incident, again, as they attempt to play down. Because essentially, Matt, if you don't report a crime, you don't have to call in the police. So here, they're not saying that there's been an incident and they're really hoping, in our belief, that people are just going to move on, but they can't. Because the identity theft has continued. It started a decade ago. It's continuing to this day. And then you get a tip. And everything blows wide open, Matt. And this is the great part of this story. My colleague Harvey Cashor gets a tip. An ex-con who says feeling remorse that he wants to do something to help victims, he shares with us a list with 28,000 names on it, 28,000 names,

personal information, social insurance numbers, telephone numbers, birth dates, etc. All the ingredients that fraudsters need for identity theft. He says he bought this through the dark web, points the finger directly at BC's interior health and says that's where we got the information it's been bought and sold multiple times over the years so the fifth estate publishes a story asking other people who may have been impacted by this to come forward what happened who did you hear from well uh that's when my colleague harvey cashier's both phone and email exploded with people saying a simple question am i on the list because this is what i was talking about in the outset there's been a data breach here and a lot of these people didn't even know about it and they were coming to the fifth

if the state to find out. Is my information currently, you know, for sale on the dark web? So we're telling them that there's been this data breach. We're telling them that they should be protecting themselves. And it's through that that we met this incredible nurse. She's from Colonna. Her name is Ashley Stone. She started the fight for accountability at BC's Interior Health a decade ago. She came to us. We told her, yes, you're on that list. And then she became really a key ally in our investigation. So Ashley Stone is in our studio in Colonna. She worked as a nurse with interior health. Ashley, good morning to you. Good morning. This is an amazing story. Take us back to the beginning. When did you realize that your identity had been stolen? Yeah. So it was December 2014.

I was still on maternity leave. And I essentially received a credit card in the mail that I didn't apply for. It was through Canadian Tire. And it had my maiden name on it, which at the time I hadn't used for over three years. And had I not heard of other colleagues experiencing identity theft on my ward, I might have ignored that. But because I had heard of other people experiencing that, I essentially started the process of discovering that I was the victim of identity theft. What did you do? I mean, you get this credit card in your maiden name, as you say, you haven't used it in a while. What did you do? You contact Canadian tire and say, I didn't apply for this? Yeah. So first I contacted one of my colleagues because I didn't even know.

where to start. And she kind of gave me the steps of what to do. And so next, I contacted Canadian Tire. And they were able to give me some information that immediately made me think that this was from Interior Health, because in order to apply for this credit card, you had to list your employer as well as the year you started or how long you'd been working for that employer. And I barely know that information off the top of my head. So for someone else to know that would have to have access to that information. And then from there, I just had to contact the Credit Bureau of Canada, the two of them, so Equifax and TransUnion, and it revealed all of the other credit cards, bank accounts, lines of credit that were taken out in my name. Credit cards, bank accounts,

lines of credit. Tell me more about the fraud that was happening ostensibly, you know, in your name. So I think I had about five different credit cards, a couple cell phones. I had an overdraft at CIBC Bank for over $5,000. I had a line of credit through TD, which was really interesting because whoever this fraudster was had to sit down with a banker and pretend that they were me. And all of this happened within two weeks

from the time it started to me finding out was two weeks and the damage was extensive. There are two kinds of Canadians, those who feel something when they hear this music. And those who've been missing out so far. I'm Chris Howden. And I'm Neil Kuxel. We are the co-hosts of As It Happens.

And every day we speak with people at the center of the day's most hard-hitting, heartbreaking, and sometimes hilarious news stories. Also, we have puns. Here Why As It Happens is one of Canada's longest running in most beloved shows. You can find us wherever you get your podcasts. What was the damage? I mean, when you have things like that, a credit card or, you know, you're making purchases. Eventually people want to be paid.

And if they're not paid, the debt collector comes knocking. Did that happen? Oh, absolutely. So I first had to try and cancel all of these cards, and it's not just a simple phone call. You're on the phone for a very long time, and then you have to go through their fraud department, and then they'll get back to you. And then by the time that they get back to you, you are now getting debt collector calls and mail, and it's just a super long process to try and clear it. And not only that, in the meantime, before it's cleared, it tanked my credit score. My credit score, is nearly perfect, and I pride myself on that, and it tanked it to 300. And so, as you said, you suspected that perhaps this came from your workplace, because there was information about when you started at Interior Health, for example, that you couldn't remember that they somehow had. When you go to BC Interior Health and say, I think my data has been stolen, what did they say?

I think it was essentially the day after. So December 2014, I'm reaching out to someone in the privacy. part of Interior Health, the information technology. And I really felt like, you know, we were going to be a crack team and figure this out and they were going to listen. And that just wasn't the case at all. What did they say? It started with, you know, tell us what happened. And it seemed like they were concerned and caring. Then it became, like Mark had said, very deny and deflect. So after I talked to one person several times, he essentially escalated me to his manager, who then very much told me that there's no way it could have been from Interior Health, that they would

see hundreds of people experiencing this, and that wasn't the case. They gave me a list of other possible places this could have come from, and one of them was Blue Cross had had a breach, and I think that might have pacified the people who came before me as that was where their breach came from, but being a casual employee, I have never had benefits through Interior Health, therefore had never had Blue Cross. And so when I told them, that they started seemingly scrambling and in an email essentially said that someone could have got my information by dumpster diving. What did you have to do?

I mean, you're not satisfied with what you're hearing back from your employer. So what did you do then? I did all the things that I feel like you should do. I put flags on my credit records through the TransUnion at Equifax. I notified the police. I tried to tell all of the colleagues that would listen to me. I tried to get into your health to even send out a blanket email, not even something admitting anything, but just a blanket email saying that there has been reports of identity theft and just

beyond the lookout. I felt like I did everything that I could do. I've knocked on every door possible and nothing has opened up until now. Sounds like you're doing the job that you thought maybe they would do. Absolutely. What kind of stress? I mean, you talked about your credit score tanking, but that's a lot of stress as well, right? knowing that somebody or some people are trading on your name, but also then having to chase down

this information. What did that mean for you in terms of just, as I said, like the weight on your shoulders? Yeah. So like I said, I had a one-year-old at the time. So, and he was a high-needs baby. And so any nap time, that is when I was on the phone. And that, as any new mom knows, is a precious time to be doing other things rather than calling one-eighthundred numbers. Yeah. And this wasn't isolated to 2014 or even 2015. This has affected me every single year up until last year, I think, was the most recent issue. Now I have four kids and my time is really precious to me. So every time I get something in the mail with my maiden name, it just is a pit in my stomach of here we go again. Why are you talking out about this? I mean, you've left BC Interior Health. You don't work there anymore. But you're speaking publicly about. this. Why is that important for you to do? So technically I still am employed with interior health. I haven't worked there since February. You know, it's always been important for me to speak out. In

2015, I had reached out to several media outlets that were interested in the story, but there is some strict policy within interior health that you can't speak publicly to the media. And I had reached out to my union to ask, you know, can you protect me if I speak out about this incident that I'm very passionate about. And they said they couldn't guarantee my protection. And so I stayed quiet up until now. And fortunately, my livelihood doesn't depend on interior health anymore. So I feel more comfortable to speak out, especially speak out for those people who don't

feel comfortable to do so. I'm glad that you've done that. Stay with us. Mark Kelly is with us in our Toronto studio. What do you make of what you've heard? Well, I mean, I also want to remind our listeners, Ashley's a frontline health care worker. You want to talk about people who already have enough stress in their lives, and this is something that she's been doing for more than a decade.

And on top of that, she's now advocating on behalf of other workers. And I also want to point out she's not alone in that there were other people in an investigation. Other people, other workers who came forward to interior health and said, hey, folks, I think we have a problem here. So she was not a voice in the wilderness. There were others. There are paper trails, emails of other people contacting, as well as the RCMP to tell them that they've got a problem.

and yet they still don't admit that responsibility. So when the fifth, the state comes knocking on the door of BC Interior Health and asks questions about the data breach, what does BC Interior Health say? Well, they don't open that door for one thing. I mean, look, we have a list with 28,000 names on it. You know, we contact Interior Health and tell them we've got this list. They never even asked to see the list. I mean, this goes back to my point about denial.

We're calling this story the denial machine because that's what we've come up against. Now, after the RCMP got 20,000 names, 7,000 active interior health employees, they did speak to global news, and we were able to get our hands on a clip that was run. This is the Interior Health VP of Digital Health, who spoke to global news after the RCMP turned up this list. His name is Brent Crucial. We're actually unaware, unsure of how this information came into possession of the individual when the RCMP discovered the file. But it is concerning. It's sensitive information.

We want to reach out to employees, both active, and inactive and make sure they're aware of this discovery and have the opportunity to protect their identity through credit monitoring. And it almost sounds like this came out of the blue that they're saying, well, we don't know how this happened, but we're going to offer credit monitoring, which, by the way, for people who have already had, as Ashley was pointing out, their credit shot, credit monitoring is not going to do a world of good. Did Interior Health say why they wouldn't talk to you about this? Was there any explanation? They say that there's an ongoing RCMP investigation. I've contacted a senior official in the RCMP to find out more.

about that. He's unaware of that investigation. We're trying to find out more. You brought this to the BC Privacy Commissioner, Michael Harvey. What did Michael Harvey have to say about this? Well, he said he feels sorry for the victims. And I said, I'm sure that means a lot to them. But more importantly, will you launch an investigation into BC Interior's handling of this data breach? The answer is no. He says, look, I need evidence that they didn't meet their legal obligations in protecting the workers' information. I said, I have a list of 28,000 names with personal information in it. What more evidence do you need? He says, that's not good enough for me right now. It's a matter for the courts. And so you go further up the

chain and ask for an interview with the BC Health Minister, Josbord. What happened there? Once again, told we won't be able to talk about this citing an ongoing RCMP investigation. Again, we're not sure what investigation they're referring to. We showed up in an industry event where the minister was speaking. I'm the only journalist right there. I said, okay, I've just flown in from Toronto. I've got a few questions on behalf of the tens of thousands of workers at interior health. Will they get an apology? Will they get a better understanding? Will they get truth and transparency about this data breach? She tells me, and you will see this in our documentary, I'm sorry, I have to catch a plane. That's the end of the conversation. And walks away.

Ashley, you have been listening in as we've been talking to Mark about this investigative process. This is, as you said, I mean, you were getting mail in the last year. year with your maiden name in it, a name that you don't use anymore, this could track you around for the rest of your life. What do you want to see done here? What are you looking for? Yeah, absolutely. It can follow me for the rest of my life. And, you know, what I would like to see is obviously accountability. An apology to this day, Interior Health still says that I am not on any list that they've encountered. So for the people who have been on that list that was found in 2024, they get, you know, two years of credit monitoring, which I mean isn't a whole

whole lot. But at least they have been acknowledged that they were a victim. And I still don't have that. The only confirmation that I got was through Harvey and his reporting that finally I could say that I was on a list. So obviously I would like accountability. I would like policy change of when something like this happens. And for people who don't know what to do when this does happen to them, that they have some resources to go to because right now I'm the resource. I just got a message from a colleague two, three weeks ago, you know, saying, I think I've been the victim, now what? You know, I'm happy to be a resource and an advocate for people, but there should be a more formal process. Ashley, I'm really glad to talk to you. I wish you the best

of luck. And thanks for being willing to speak with us. Thank you. And Mark, thank you. Thanks, Matt. Ashley Stone is a nurse and former employee of BC Interior Health. She was in our Colonna Studio. Mark Kelly, co-hosts with the Fifth Estate, his new investigation, the denial machine. You've been listening to the current podcast. My name is Matt Galloway. Thanks for listening. I'll talk to you soon. For more CBC podcasts, go to cbc.ca.ca slash podcasts.