Fake Flu Clinic Harvested Health Card Numbers

BARRIE, Ont. — November 5, 2026 — By the time the real clinic opened its doors on Monday morning, 214 people had already booked their flu shots — through a website the clinic had never built. The appointments were confirmed, the reminders were sent, and the patients were told to bring their health cards. The clinic itself had no record of any of them.

The booking page had not broken into anything. It had simply arrived first. A copy of a fictional Barrie community health centre’s flu-shot clinic, complete with the centre’s name, its hours, and a reassuring note that appointments were filling fast, it asked each visitor for a name, a date of birth, a phone number, an email address — and a health card number, supposedly to confirm eligibility. The centre never asks for a health card number online.

The clinic had not been hacked. Its appointment book had been replaced.

According to the fictional health centre at the centre of the story, the pattern surfaced only when patients began arriving with confirmation emails the centre had never sent. The messages came from an address close to the centre’s own, and the page they linked to carried the centre’s colours and its flu-season poster. Patients who called the number on the fake page were told their appointment was confirmed and to arrive ten minutes early. None of them appeared on the centre’s real schedule.

“We run a free clinic. Nobody pays, and nobody books with a health card number,” said Elena Marsh, the fictional centre’s operations coordinator. “But the page looked like ours, it used our name, and it reached people through the same parent groups and seniors’ chats where we share our real notices. People did exactly what we ask them to do — they booked early. They just booked with the wrong page.”

A health card number, paired with a name and a date of birth, is a key to identity theft.

Health-privacy and cybersecurity advisors say booking portals are attractive precisely because they are routine, trusted, and time-sensitive. A flu clinic does not need to be breached in the dramatic sense — an attacker only needs to copy a trusted local service onto a convincing page, and wait for a forwarded link to do the rest. Patients, meanwhile, trust a booking link shared by a neighbour or a community group far more readily than one from a stranger, especially when the appointment is free and the slots are supposedly limited.

“The page did exactly what it was designed to do. It collected the details that open doors,” said one health-privacy advisor familiar with copycat booking cases. “A health card number on its own is one thing. A health card number with a name, a date of birth, a phone number, and an email address is a full identity kit — enough to impersonate a patient, open accounts, and answer security questions.”

In this fictional case, the damage was not a single dramatic theft. More than two hundred people handed over health card numbers and dates of birth before the page was reported, and several later received suspicious calls quoting details only the fake booking form had collected. For the patients, the loss was compounded by the moment of discovery — arriving for a shot that was never booked, and learning that the details they had given away could not be taken back.

The fictional centre says it has since changed how it takes bookings. Flu-shot appointments now come only through the centre’s own phone line and the link printed on its notice board, never through a forwarded message alone, and staff check shared links the way they check their appointment list. Patients who used the fake page are being asked to watch for calls that quote their health card number, to report any unexpected mail or account activity, and to contact the centre directly if anyone claims to be following up on their booking.

The fix, experts say, is deliberately unglamorous: book through the source, not the share.

That advice applies well beyond one clinic. Across Canada, patients book flu shots, blood tests, and specialist appointments through links passed along in group chats and community pages, and most check them only when something goes wrong. The defence is not a cleverer booking platform. It is a habit of checking where the link came from before handing it personal details.

For patients, the checklist is short: book through the clinic’s own phone number or the link on its official notice, be suspicious of any booking page that asks for a health card number online, and check that a confirmation comes from the clinic’s own address. For clinics, it is equally simple: publish one official link, say clearly where it will come from, and give patients a simple way to report a copy.

The fictional centre says affected patients have been offered help rebooking for real, and the copycat page has been reported for removal.

The shots were free. The booking page charged them everything it could collect. And the difference — one link, checked before the details were entered — was all it took.

Watching the perimeter — and what slips past it.

ODTN News note: ODTN.News is a fictional news platform set within the Operation: Defend the North universe. All names, organizations, quotes, and events in this article are entirely fictitious. Any resemblance to real people, companies, or incidents is purely coincidental. The cybersecurity challenges it represents are very real.