Nozomi Networks/CBC: Winnipeg's largest hospital network loses HVAC and door-access central monitoring to a ransomware incident with no named actor, access vector, or ransomware family disclosed 18 days later

Manitoba's provincial health authority, Shared Health, disclosed on 2026-08-10 that Winnipeg's Health Sciences Centre (the province's largest hospital) and CancerCare Manitoba were hit by "a ransomware incident affecting certain facility maintenance systems, including HVAC and door access controls" (Nozomi Networks, 2026-08-12). Central monitoring of heating, ventilation and cooling was lost (the equipment itself kept running and was switched to local/manual monitoring) the hospital's security office was closed, and staff could not issue or update physical ID access cards, prompting the Manitoba Nurses Union to flag entrance-security concerns given a history of violent incidents at the facility. Clinical care and patient-facing IT systems were not affected: "clinical services continue uninterrupted, and based on the investigation conducted to date, there is no indication that patients have been affected" (Shared Health, via CBC News, 2026-08-10), which Nozomi Networks' analysis credits to IT/OT network segmentation having held between the clinical and facility networks.

As of CBC's most recent status update (2026-08-17, one week post-disclosure), Shared Health's investigation had still not attributed the incident to a named ransomware group, disclosed an access vector, or confirmed whether personal health or financial data was accessed; initial review suggested none was: "the health authority says its investigation has found the attack has affected central monitoring of its heating, ventilation and cooling systems but that they are still operating and being monitored locally" (CBC News (The Canadian Press), reporting Shared Health's update, 2026-08-17). No extortion group has claimed the incident on a leak site.

Nozomi frames the transferable lesson as structural rather than incident-specific: hospital building-management systems (BACnet-class protocols, often a decade-plus without patching, owned by facilities teams outside IT's asset inventory) sit on the same class of network reachability as any other IT asset, so ransomware that never specifically targets OT can still disable HVAC and access-control availability as a side effect. In a hospital, ventilation loss is itself an infection-control failure under ANSI/ASHRAE/ASHE 170 pressure-relationship and air-change requirements, not merely a comfort issue; the transferable point this constituency's healthcare-sector estates should carry regardless of Winnipeg's specific vector, which remains undisclosed.