Canada

Canada: NL Health's Fake Day-Off Email Was a Phishing Test

Was this an unforgivable betrayal of burned-out workers or a flawed but fixable cybersecurity necessity?

Published JUN 23

Canada: NL Health's Fake Day-Off Email Was a Phishing Test

Story

Above: A spam "phishing" email is displayed on a laptop screen. Image credit: Peter Dazeley/Getty Images

The Facts

Newfoundland and Labrador (NL) Health Services sent a "June Holiday" email on June 16 to thousands of employees promising a paid day off in recognition of their work during the rollout of CorCare, a new digital health information system.
Canadian HR Reporter
CBC
The email, however, was part of an internal cybersecurity awareness exercise designed to track employees who clicked an embedded link. It was sent from an outside domain, remailmail.com, and was later revealed to have been developed with consultants at Ernst & Young.
CBC
Guardian
NL Health Services interim CEO Ron Johnson apologized and said the test "missed a mark" and was "not reflective of how we value our employees." An investigation was launched into the approvals process behind the exercise.
The Register
SC Media
Union leaders condemned the exercise, with NAPE president Jerry Earle calling it "nothing short of cruel," noting members had been denied vacation and worked long hours during the CorCare launch. Earle said at least one worker quit following the incident.
Canadian HR Reporter
CTVNews
CorCare, expected to cost CA$600 million ($422 million) over a decade, was implemented on April 25. The rollout faced controversy, including a mandatory sign-on requirement that was later made voluntary and contract changes removing physician liability for privacy breaches.
CBC
Canadian HR Reporter

Sources Split

LEFT

CENTER

RIGHT

ESTAB
CRIT

CENTER

PRO
ESTAB

The Spin

Government-critical narrative

NL Health's phishing test — which dangled a fake paid day off to exhausted health care workers — was a massive failure of judgment. Staff who sacrificed vacation time and family life during the chaotic CorCare rollout deserved real recognition, not a cruel bait-and-switch. Genuine appreciation means something, but exploiting burnout to run a cybersecurity drill is a complete insult. There must be accountability for this.

Registered Nurses' Union of Newfoundland & Labrador

CUPE

CBC

Pro-government narrative

NL Health's phishing test was a misstep, but the organization owned it fast — the interim CEO publicly apologized, called the approach inappropriate and promised a full review. Cybersecurity awareness is critical in health care, where attacks can cancel procedures and cost lives. One poorly designed drill doesn't erase the genuine need for these exercises. The real fix is better oversight, not abandoning the practice altogether.

The Register