The union representing nurses in Manitoba is concerned about security risks for its members following a ransomware attack that has impacted some maintenance systems at the province’s largest hospital.

Darlene Jackson, president of the Manitoba Nurses Union, says it is troubling that the breach is affecting some of the door access at Winnipeg’s Health Sciences Centre after the union declared the hospital too dangerous to work at last year because of safety concerns.

Shared Health, the body that manages health care in the province, announced on Monday that it was dealing with an attack affecting certain facility maintenance systems, including heating, ventilation and cooling systems, and door access.

It says patient care and clinical operations remain unaffected and fully operational.

Jackson says she is not aware of which doors have been impacted, but that she heard Shared Health has sent security guards to man the entrances.

Shared Health has not said when the breach occurred, whether it has been addressed or if the hackers made demands.

“Clinical services continue uninterrupted, and based on the investigation conducted to date, there is no indication that patients have been affected,” Anya Willis, communications specialist with Shared Health, said in an email on Tuesday.

The hospital is investigating the breach, which includes a “thorough review” of affected systems, Shared Health has said.

The province was notified and the health body is working with third party experts to resolve the incident.

Jackson said union staff were notified of the attack late Monday afternoon.

“If there has been a breach that allows doors to be unlocked, that is a big concern for us,” she said.

It’s not clear to the union which doors are impacted by the attack, added Jackson.

Manitoba’s auditor general called for better cybersecurity at Shared Health in a 2024 report.

Tyson Shtykalo said the health care body has a process to respond to cyberattacks but has not been running tests for scenarios such as ransomware or data theft.

The report recommended annual testing and more training for cybersecurity incident response team members.