sc

STRICTLY CONFIDENTIAL – URGENT ACTION REQUESTED
This is a notice that REDACTED’s infrastructure is being misused by a criminal threat actor.
My name is Marc Vani. Eric Charleston (cc’d) and I are lawyers with Borden Ladner Gervais LLP. We are counsel to Sunnybrook Health Sciences Centre, a hospital in Toronto, Ontario, Canada.
Sunnybrook has been responding to a cyber attack that first came to its attention on October 29, 2026, during which a threat actor stole data from its systems.
Sunnybrook has uncovered evidence that the threat actor exfiltrated data to destination IP address REDACTED, which we understand is registered to REDACTED. Sunnybrook has uncovered the following malicious activity:
Exfiltration

* Originating IP address: 142.76.1.62
* Destination IP address: REDACTED
* Date and time of data exfiltration:
* Start: 2026-10-27 02:49:41 EDT (2026-10-27 06:49:41 UTC);
* End: 2026-10-28 03:53:46 EDT (2026-10-28 07:53:46 UTC);
* Total Volume of data transfer: 297,677,699,204 bytes sent (297.68 GB) across all 10,463 deduplicated SSH sessions over the full 25-hour window (including 123,250,292,649 bytes [123.25 GB] in a single 2-hour SSH session).
* Note that Sunnybrook detected 236,829,535,801 bytes (236.83 GB) sent over the course of 2,228 sessions.
* SSH Public Key (generated on Sunnybrook’s systems by the threat actor) installed on REDACTED (created 2026-10-27 06:50:07 UTC as /root/.ssh/REDACTED.pub): REDACTED
* SSH Key Fingerprints (logged in /var/log/REDACTED.log or /var/log/REDACTED on REDACTED):
* SHA-256 Fingerprint: REDACTED
* MD5 Fingerprint: REDACTED
Infiltration:

· Initial HTTPS archive download to Sunnybrook’s systems:

* Originating IP address: REDACTED
* Destination IP addresses: 142.76.1.36:443 and 142.76.1.107:443
* Volume: 183,530,000 bytes (183.53 MB) to 142.76.1.36:443 and ~16,000,000 bytes (16 MB) to 142.76.1.107:443.
* Date/time: 2026-10-26 22:04:34 EDT (2026-10-27 02:04:34 UTC) through 2026-10-27 00:28:43 EDT (2026-10-27 04:28:43 UTC).
* Subsequent Re-Access
* Originating IP address: REDACTED
* Destination IP address: 142.76.1.36:443
* Date/time: 2026-10-29 22:16:56 EDT (2026-10-30 02:16:56 UTC) through 2026-10-29 23:49:20 EDT (2026-10-30 03:49:20 UTC).
Other indicators of compromise and investigative aids:

· Sunnybrook Source/Destination IPs to Search in REDACTED logs:

* 142.76.1.62 (Sunnybrook NAT IP connecting inbound to REDACTED:22)
* 142.76.1.36 (Sunnybrook Mitel gateway accessed outbound from REDACTED:443)
* 142.76.1.107 (Sunnybrook MyChart portal accessed outbound from REDACTED:443)
* Attacker Webshell / Script Markers on REDACTED
* Target script: REDACTED (REDACTED)
* Custom HTTP Header sent from REDACTED X-S: REDACTED
* File & Content Signatures of Sunnybrook Data on Disk:
* Clinical PDFs named _ _HFN_ _*.pdf or *_MRN_*.pdf
* SQL/HTML exports referencing "sunnybrook.ca", "sw.ca", "mychart", "mychartaudit", "MOSAIQLog_", "neo-datasource.xml", and Exchange EWS SOAP dumps for @sunnybrook.ca / @sw.ca.
Requests
Sunnybrook requests that REDACTED:

1. Take immediate steps to freeze and preserve the stolen data, and account(s), server(s), or other infrastructure, associated with this transfer, and to prevent the stolen Sunnybrook data in REDACTED’s custody or control from being further transferred, accessed, deleted, altered, or otherwise processed.
2. Advise if the account(s) associated with the theft of Sunnybrook’s data are current, and if the account(s) are delinquent, whether the account(s) (and the data held within such account(s)) are queued for deletion.
3. Provide a full file listing of Sunnybrook’s data transferred to REDACTED-controlled systems by the threat actor, and immediately return all such data.
4. Immediately preserve all records and logs relating to the foregoing activity and associated account(s) and infrastructure, including all logs related to the exfiltration of Sunnybrook’s data, and any records that may identify the relevant account holder or user and any available access, authentication, connection, network, transfer, billing, subscriber, and account records. Please ensure that potentially relevant records are not deleted or overwritten through ordinary retention or log-rotation processes.
5. Treat this communication as strictly confidential and not disclose this request, or the fact that Sunnybrook has identified the above infrastructure, to the owner or user of the relevant account(s) or infrastructure. Sunnybrook has reason to believe that the relevant account or infrastructure belongs to, or is controlled by, the threat actor responsible for the attack against Sunnybrook. Disclosure could alert the threat actor to Sunnybrook’s investigation and create a serious risk of further harm, including the movement or destruction of Sunnybrook’s stolen data and potentially relevant evidence. If REDACTED shares information with the threat actor, Sunnybrook will hold REDACTED accountable for any harm that it suffers as a result.
This is of the utmost importance to Sunnybrook and time is of the essence. Please acknowledge receipt of this communication at your earliest convenience. If REDACTED requires any further information to effect the request above, please let the undersigned know as soon as possible.
Please note that Sunnybrook has reported this incident to the FBI, and has requested that they issue a letter pursuant to 18 U.S.C. § 2703(f), ordering the freeze of the data and preservation of evidence.
Best Regards,
Marc

[cid:[email protected]]
Marc Vani
Associate
MSc, CIPP/C
T 416.367.7266 | [email protected]
Bay Adelaide Centre, East Tower, 22 Adelaide St. W, Toronto, ON, Canada M5H 4E3

BLG | Canada’s Law Firm
Calgary | Montréal | Ottawa | Toronto | Vancouver
blg.com | To manage your communication preferences or unsubscribe, please click on blg.com/mypreferences/

Borden Ladner Gervais LLP
This message is intended only for the named recipients. This message may contain information that is privileged, confidential or exempt from disclosure under applicable law. Any dissemination or copying of this message by anyone other than a named recipient is strictly prohibited. If you are not a named recipient or an employee or agent responsible for delivering this message to a named recipient, please notify us immediately, and permanently destroy this message and any copies you may have. Warning: Email may not be secure unless properly encrypted.