The Icon Cancer Centre group has confirmed that patient information was stolen, and it didn't come from its main computer systems. It came from an outside service that turns incoming faxes into emails.

Photo: Pittigrilli / Wikimedia Commons (CC BY-SA 4.0), cropped