More bad news following Oxford County cyber attack

Lee Griffi, Local Journalism Initiative Reporter

Oxford County is advising the public that personal and private information collected by some programs and services was compromised as part of the County’s cyber incident discovered in September 2025.

In a press release, the county said it has been conducting a comprehensive review of current and archived files and records to determine who was impacted and what types of personal information were accessed. While this work continues, the county is advising the public that personal information was accessed or acquired from some programs and services:

• Social housing and social assistance programs between 2020 and 2025, including Ontario Works, licensed childcare service providers, and childcare fee subsidy applications.

• Housing funding programs between 2022 and 2025, such as the Home Ownership Program, My Second Unit, or the Residential Repair Program.

• Job applicants who were selected for an interview at Oxford County.

Tech expert Carmi Levy said it’s no surprise the county is dealing with latest announcement.

“This particular event in Oxford County follows a well-worn trajectory we have seen in other municipalities. It often takes time for the victims to do a full forensic analysis to better understand whether data was compromised as part of the attack and, more importantly, what data was included.”

Levy said there is now a better indication of what the impact was and the county has released a comprehensive list of the types of information, the dates, as well as the effected platforms and services.

“At the very least, those individuals whose data was included, can begin taking appropriate cautions.”

The County is providing complimentary credit monitoring services to eligible individuals whose personal information was accessed or acquired in the County’s September 2025 cyber incident.

“If a resident believes they may have been impacted, based on the information outlined in the notice on our website, they should contact privacy@oxfordcounty.ca and provide their name (first and last) and the name of the program and/or service they applied for, to inquire about their eligibility,” said County CAO Ben Addley.

Levy explained it can take days, weeks, or in this case, months, to fully understand the extent of the damage done and then to build an appropriate communication plan around it.

“There’s no indication the perpetrators of this attack were providing any additional pressure on the county but what is more likely the case is it took the county this long to figure out what happened and to figure out how to tell everyone what happened.”

Levy said anyone affected by the newest release of data breach victims needs to take it very seriously and take the appropriate steps to protect themselves.

“It is a very dangerous assumption to assume this data is not highly personal and highly damaging in the wrong hands. They should be acting to reduce their risk going forward. You can not afford to not take this seriously.”

He added information such as driver’s license, health card, other government issues identification and even information contained in a job application are highly damaging in the hands of a criminal.

“When the data is out there, it isn’t just being used by those who stole it, it is also being sold to other criminals who will use it in subsequent identity thefts and financial attacks. The risk is significant and can not be underestimated.”

Anyone who’s personal health care information may have been accessed will receive direct notification from Oxford County by mail. The municipality has reported the latest incident to Ontario’s Information and Privacy Commissioner as required by law and is fully cooperating with the Office’s investigation into it.

Oxford County Warden Marcus Ryan said it is not the update he had hoped to deliver to the community.

“We appreciate the trust and confidence our residents and partners place in us every day, and we are working to maintain that trust by responding to this incident as fully and in as forthcoming a way as we can.”

He added through each step of the investigation, the county’s focus has been on people.

“Getting information to our residents and employees as quickly as we can and supporting those affected as we learn more.”

As required by privacy legislation, a formal notice with full details about the kind of information accessed has been publicly posted to www.oxfordcounty.ca/notices and www.oxfordcounty.ca/it-incident-updates. If you were part of these programs but do not have access to email, a printed copy can be requested by calling 1-800-755-0394.

Oxford County announced a technical incident relating to its information system on Sept. 10. It was confirmed to be a cybersecurity incident on Sept. 22 through the course of the county’s ongoing forensic investigation, which was undertaken with the support of third-party cybersecurity experts.

On Sept. 24, Oxford County informed the public it had reason to believe the personal information of current and former employees may have been compromised as a result of the cyber incident.