Canada: NL Health's Fake Day-Off Email Was a Phishing Test
The Spin
Government-critical narrative
NL Health's phishing test — which dangled a fake paid day off to exhausted health care workers — was a massive failure of judgment. Staff who sacrificed vacation time and family life during the chaotic CorCare rollout deserved real recognition, not a cruel bait-and-switch. Genuine appreciation means something, but exploiting burnout to run a cybersecurity drill is a complete insult. There must be accountability for this.
Pro-government narrative
NL Health's phishing test was a misstep, but the organization owned it fast — the interim CEO publicly apologized, called the approach inappropriate and promised a full review. Cybersecurity awareness is critical in health care, where attacks can cancel procedures and cost lives. One poorly designed drill doesn't erase the genuine need for these exercises. The real fix is better oversight, not abandoning the practice altogether.