What happened?
On November 20, 2025, BioPharma experienced a ransomware attack that resulted in the unauthorized encryption of several servers. Based on our forensic review to date, there is no evidence that any personal health information was accessed or removed from BioPharma’s network.
The majority of systems and data have been successfully restored from recent verified backups. Unfortunately, one accounting system was unrecoverable and lost. It contained a limited amount of information about clinical trial participants between 2007 and the date of the incident. It is important to note that there is no evidence that any financial information was removed from BioPharma’s network. Lost information was limited to participants’ names, addresses and payment amounts, and NOT financial or banking information.
Was any information accessed or stolen?
While the ransomware encrypted certain data, some of which could not be recovered, there is no indication that any personal health information or other personal data relating to clients or participants in clinical trials was accessed, copied, or exported by unauthorized parties.
What has been done?
BioPharma has contacted the Information and Privacy Commissioner of Ontario about this matter, as well as law enforcement. We have confidence in the security of our systems and feel we have done everything necessary at this time to continue operating safely and protect the sensitive personal information in our custody. We are actively monitoring systems to help defend against future attacks of this nature and are working to enhance our cybersecurity safeguards.
What can I do?
It is always recommended to be vigilant and report any suspicious activity to the appropriate authorities. Tips and resources for protecting your identity are available at https://www.priv.gc.ca/en/privacy-topics/identities/identity-theft/guide_idt/.
Who should I contact if I have questions?
If you have questions regarding this notice, please contact us at privacy@well.company. When reaching out, kindly provide your name and phone number so we can assist you promptly.
You may also contact the Information and Privacy Commissioner of Ontario (IPC), 2 Bloor Street East, Suite 1400 Toronto, ON M4W 1A8, 1-800-387-0073 or info@ipc.on.ca. You have a right to complain to the IPC, though it is not required, and we will fully cooperate with the IPC.
