A local privacy consultant says Hive Ransomware, the group behind the cyberattack on the province’s health care system, was a sophisticated operation, now dismantled by the FBI and US Department of Justice.

Dave Morgan of Morgan Privacy Consulting says Hive operated on a service model, producing ransomware that was used by affiliates who conducted the cyber attacks.

He says the money obtained would then be shared on an 80/20 split. Morgan says the US Department of Justice estimates there were about 1,500 victims worldwide with Hive getting approximately $100 million in ransom.

The cyberattackers were in the system for a few weeks before they were detected according to the provincial government. Morgan says it’s hard to determine if that is unusual.

He says the cyberattackers didn’t really start their attack until a few days before it was discovered.