Cruel cyber training in Canada: testing if exhausted employees would fall for a 'day off' scam

If you received an email with a link to register for an extra day off, would you click it? For a brief moment, exhausted healthcare workers thought their employer was finally rewarding them, only for the promised holiday to turn out to be a phishing test to see if they fell for it.

Thousands of healthcare workers in Canada's Newfoundland and Labrador province opened an email this week, believing their employer was finally recognizing months of overtime with an extra paid holiday.

Instead, they discovered the email was part of a staged phishing attack intended to test their cyber awareness. The union leaders representing the healthcare workers called the exercise "cruel," "insulting," and potentially damaging to an already strained workforce.

Workers say the test crossed a line

Phishing simulations have become a common cybersecurity training tool across industries.

Organizations use them to identify employees who may be vulnerable to social engineering attacks and to reinforce cybersecurity awareness.

This is an especially sensitive topic for healthcare organizations, as they handle a large volume of sensitive patient information and have been on the radar of cybercriminals.

But this time, the phishing test crossed a line. Employees of Newfoundland and Labrador Health Services (NLHS) received an email on Tuesday informing them they were eligible for an additional paid day off.

The message framed the reward as recognition for employees' efforts during the rollout of CorCare. This new province-wide health information system has significantly increased workloads for many healthcare workers.

The email encouraged staff to register for what it called a "June Holiday," describing it as an acknowledgment of employees' work through "a significant period of change."

But what infuriated the staff was that the offer was not real. The email was part of a phishing simulation designed to test whether employees would click on suspicious links.

Staff later learned that the message had originated from an external domain and was never intended to provide an actual holiday.

The test infuriated the staff

Reportedly, Yvette Coffey, president of the Registered Nurses Union Newfoundland and Labrador, said the exercise struck a nerve among workers who have been dealing with mandatory overtime, denied leave requests, and the pressures of implementing the new CorCare system.

"It was actually insulting, degrading, disrespectful," Coffey said to CTV National News.

"Our members are mad, and so am I."

For many healthcare workers in Newfoundland and Labrador, the issue was not cybersecurity training itself. It was the choice to use a highly desired day off as bait during a period when staff are already reporting exhaustion and burnout.

One employee said they became emotional after reading the message.

"When I first read the email, I teared up. For a moment, I felt like our hard work and dedication were finally being recognized," the worker wrote.

"Instead, I was left feeling foolish."

Jerry Earle, president of the Newfoundland and Labrador Association of Public and Private Employees (NAPE), said some workers have become so frustrated that the incident may accelerate retirement decisions.

"I've heard from some already, saying, 'I could have retired 6 months ago. If this is the way my employer is going to respect me, I'm out of there,” Earle said.

NLHS publicly apologized

NLHS has acknowledged the backlash and publicly apologized.

Interim CEO Ron Johnson described the exercise as a mistake and said an investigation would determine how the phishing scenario was approved and whether it was created internally or by external consultants from Ernst & Young.

"This really missed a mark," Johnson told reporters.

"What happened here, obviously, is that all the lenses that were required to review the scenario weren't placed on it."

Johnson emphasized that the exercise does not reflect the organization's view of its employees.

"It's not reflective of how we value our employees."

Unlock more exclusive Cybernews content on YouTube.