Unions criticize NL Health Services phishing exercise that used fake paid leave offer

Two health-care unions are condemning Newfoundland and Labrador Health Services after a cybersecurity exercise used a fake offer of paid leave to test employees, calling the tactic insensitive and poorly designed.

NAPE and the Registered Nurses’ Union both issued statements Wednesday criticizing an internal phishing simulation sent to health-care workers on June 16.

The email, titled “June Holiday,” appeared to recognize employees for their work during the transition to the CorCare system and suggested staff would receive an additional paid day off “in recognition of that contribution.” It then prompted employees to click a link to register for the benefit, as part of a test to measure phishing awareness.

NAPE said it was “outraged” by the exercise, arguing it exploited the efforts and sacrifices of health-care workers during a period of high workload and organizational strain.

“I am absolutely disgusted that NLHS would do this to our hardworking healthcare staff,” NAPE president Jerry Earle said in a statement. He said many workers had their vacations denied, worked extra hours and made personal sacrifices during the CorCare rollout.

“Treating employees this way is unacceptable,” Earle added, calling for an apology and saying those responsible should be removed from their positions.

The union said it only became aware of the email after members contacted it to verify whether the message was legitimate.

The Registered Nurses’ Union also said the exercise was in poor taste, though it emphasized that it supports cybersecurity training in principle.

“Yes, we have heard concerns from members about this, and frankly, I understand why they are upset,” RNU president Yvette Coffey said. “Cybersecurity education is important, but it needs to be done with judgment and respect.”

Coffey said the use of a fake promise of an extra paid day off was particularly insensitive given ongoing staffing pressures, burnout, and challenges tied to the CorCare implementation.

“At a time when staff are exhausted, when many are struggling to access leave, and when employees are being asked to manage significant change across the system, this message was bound to feel insulting,” she said.

Both unions said health-care workers deserve genuine recognition for their efforts, not simulations that rely on promises of benefits that do not exist.

NL Health Services has issued an apology.