On February 1, 2024, Ann & Robert H. Lurie Children’s Hospital in Chicago announced on its website and social media channels that it is responding to a cybersecurity incident and has been forced to take its network systems offline. The cyberattack has been reported to law enforcement agencies and Lurie Children’s is working collaboratively with those agencies and third-party cybersecurity experts to investigate the attack and bring network systems back online as soon as it is safe to do so.

The 360-bed acute care hospital is a leading provider of pediatric care in Illinois and one of the biggest children’s healthcare providers in the Midwest, serving 239,000 children each year. The cyberattack has disrupted normal operations and caused delays to medical care for certain patients, with ultrasound and CT scan results temporarily unavailable. Some appointments and elective procedures have been canceled to ensure patient safety. The hospital has confirmed that its emergency services are unaffected, and it is operating under a first-come, first-served approach and is prioritizing emergency patients.

The system-wide network outage has affected computers, Internet access, email, and phone lines at the main hospital, outpatient centers, and primary care offices. Lurie Children’s Hospital apologized for the inconvenience caused and said it is actively working to resolve the issue as soon as possible and is trying to minimize the disruption to patients as far as possible. Lurie Children’s has been working on establishing an emergency helpline to address patient families’ and community providers’ needs but it was not possible to provide a timeline for when normal operations will resume.

Little information has been disclosed so far about the nature of the attack. No ransomware groups appear to have claimed responsibility at this stage. Naturally, at such an early stage of the incident response, it is not possible to tell if any patient data has been stolen. Lurie Children’s will provide updates as the investigation progresses. Just a few days ago, another Chicago hospital confirmed that it had suffered a cyberattack. Saint Anthony Hospital fell victim to a LockBit ransomware attack in December. The LockBit group recently added the hospital to its data leak site as it sought payment of a $900,000 ransom and gave the hospital just 2 days to make payment to prevent the release of the stolen data.

The post Ann & Robert H. Lurie Children’s Hospital Responding to Cyberattack appeared first on HIPAA Journal.

The LockBit ransomware gang has added Chicago’s Saint Anthony Hospital to its data leak site and is demanding a ransom payment of almost $900,000 from the nonprofit hospital to prevent the release of the stolen data. Earlier this week, Saint Anthony Hospital confirmed that it was still investigating the attack, which was detected on December 18, 2023. Saint Anthony Hospital took immediate action to secure its network to prevent further unauthorized access and an investigation was launched to determine the nature and scope of the unauthorized activity. The prompt action taken by the hospital in response to the attack allowed care to continue to be provided to patients without disruption.

The investigation confirmed on January 7, 2024, that an unknown, unauthorized third party had copied files from its network on December 18, 2023, which contained patient information. Those files are being reviewed to determine the number of patients affected and the types of information involved, and that process is ongoing. At this stage, Saint Anthony Hospital is unable to say how many individuals have been affected and the specific types of data involved. Individual notification letters will be mailed to the affected individuals when that process is completed.

While the theft of patient data has been confirmed, the forensic investigation did not find any evidence that its electronic medical record database or financial systems as a whole were compromised. Saint Anthony Hospital said that as part of its commitment to data privacy, existing data security policies and procedures are being reviewed and will be updated as appropriate to better protect patient data in the future.  The incident has been reported to the Federal Bureau of Investigation, Department of Health and Human Services, and other regulators. Since some patient data has been stolen, patients have been advised to remain vigilant against incidents of identity theft and should review their account and explanations of benefits statements for unusual activity, and report any suspicious activity to their insurance company, health care provider, or financial institution.

Since the notification was issued, the LockBit ransomware group added Saint Anthony Hospital to its data leak site. The LockBit group has previously claimed that it prohibits affiliates from attacking hospitals. Last year, an affiliate conducted an attack on Toronto’s Hospital for Sick Children (SickKids), which was promptly followed by an apology from the group, and a free decryptor was issued to allow the hospital to recover files for free, and the group claimed that the affiliate behind the attack had been kicked out of its program for violating its operating rules. The latest attack suggests its policy of not attacking hospitals has been canceled. In the listing on its data leak site, the LockBit group claimed that “Always US hospitals put their greedy interest over those of their patients and clients,” apparently oblivious to the fact that Saint Anthony Hospital is a nonprofit healthcare provider.

Saint Anthony Hospital has indicated the ransom will not be paid. “As a vital safety-net hospital to the people in the communities we serve, we are dedicated to using our resources to care for our community’s most vulnerable and not to rewarding the illegal actions of bad actors,” said CIO Jeff Eilers.

The post LockBit Ransomware Gang Claims Responsibility for Attack on Saint Anthony Hospital appeared first on HIPAA Journal.

The Torrance, CA-based insurance broker Keenan & Associates has recently reported a cybersecurity incident to the Maine Attorney General that has affected 1,509,616 individuals. Keenan & Associates is part of AssuredPartners NL, one of the largest brokerage firms in the United States. The company has clients across a variety of industries, including healthcare, education, and the public sector.

The cybersecurity incident was detected on Sunday, August 27, 2023, when some of its network servers were disrupted. Action was immediately taken to contain the attack and isolate the affected network servers and third-party cybersecurity experts were engaged to investigate to determine the nature and scope of the unauthorized activity. The forensic investigation confirmed that there had been unauthorized access to its internal systems at various points between August 21, 2023, and August 27, 2023, and during that time, certain files were exfiltrated from its systems. Some of those files contained personal data provided by its clients along with some employee data. The review of those files confirmed they contained names in combination with one or more of the following: date of birth, Social Security number, passport number, driver’s license number, health insurance information, and general health information.

Keenan & Associates said additional security protocols have been implemented to enhance network, data, and system security, and its security measures will continue to be evaluated to determine if further steps need to be taken to harden cybersecurity defenses. The incident has also been reported to the Federal Bureau of Investigation (FBI) and Keenan & Associates has been assisting the FBI with its investigation.

While data theft was confirmed, Keenan & Associates is unaware of any actual or attempted misuse of the stolen data. As a precaution, affected individuals have been offered complimentary credit monitoring, identity theft protection, and identity theft resolution services. Keenan & Associates did not publicly disclose the names of the affected clients, so it is unclear at this stage whether the breach is reportable under the Health Insurance Portability and Accountability Act.

The post Keenan & Associates Data Breach Affects More Than 1.5 Million Individuals appeared first on HIPAA Journal.

CompleteCare Health Network, a health system serving patients in southern New Jersey, has recently confirmed that the protected health information of 313,973 patients has potentially been compromised in an October 2023 ransomware attack.

An unauthorized third party gained access to certain CompleteCare Health Network computer systems and attempted to use ransomware to encrypt files. CompleteCare Health Network said this was a sophisticated ransomware attack that was detected and stopped on or around October 12, 2023. Third-party cybersecurity experts were engaged to investigate the attack and determine the nature of any unauthorized activity, and whether any patient data was involved. The substitute breach notice on the CompleteCare Health Network states, “Please know that we have taken steps to ensure your data will not be further published or distributed,” which appears to confirm that there was data exfiltration, the threat group behind the attack threatened to publish the data, and payment was made to prevent that outcome.

CompleteCare Health Network conducted a review of all files on the affected systems and confirmed they contained protected health information. The types of information involved varied from patient to patient and may have included names, phone numbers, addresses, and some sensitive personal information and/or personal health information. Notification letters started to be mailed to the affected individuals on December 15, 2023. Each individual notification letter states the exact types of data involved. CompleteCare Health Network said no reports have been received to indicate any actual or attempted misuse of patient data, but as a precaution, complimentary credit monitoring and identity theft protection services have been offered to the affected individuals.

“Data security is one of our highest priorities. Upon discovering the incident, we immediately took the affected systems offline and began the process of securing and confirming the fortification of our systems,” said a spokesperson for CompleteCare Health Network. Measures taken in response to the breach include revising policies and procedures and network security software, and reviewing how patient data are stored and managed. Since the attack, the network has been monitored 24/7 by third-party cybersecurity experts and CompleteCare Health Network has engaged leading cybersecurity firms to assist with monitoring its network for the long term.

The post 314,000 Patients Affected by Cyberattack on CompleteCare Health Network appeared first on HIPAA Journal.

Plaza Radiology, which does business as Chattanooga Imaging across several locations in Tennessee and North Georgia, has suffered a cyberattack and data breach that has affected up to 569,000 patients.

Plaza Radiology identified the cyberattack on October 21, 2023, but did not disclose any details about the nature of the attack, other than stating that the initial results of the forensic investigation confirmed there had been unauthorized access to a small number of files on its network that contained patient information.

The analysis of the results from the forensic investigation is ongoing and, at this stage, there have been no reports of any actual or attempted misuse of patient data. Plaza Radiology reported the data breach to the HHS’ Office for Civil Rights on December 20, 2023, and said it will be mailing individual notification letters to the affected patients when the specific individuals affected have been identified and the types of data involved have been determined.

Legal counsel for Plaza Radiology confirmed that several steps have been taken in response to the security breach to improve cybersecurity and prevent similar breaches in the future. Those measures include changing passwords on accounts, enabling multi-factor authentication, replacing the affected desktop computers and network servers, and providing enhanced security awareness training to the workforce.

Plaza Radiology has confirmed that complimentary credit monitoring and identity theft protection services will be offered to individuals whose sensitive information was accessed in the attack and encourages all patients to be vigilant against identity theft and fraudulent uses of their data.

The post Plaza Radiology Data Breach Affects Up to 569,000 Patients appeared first on HIPAA Journal.

Columbus Regional Healthcare System in Whiteville, NC, has notified the Maine Attorney General about a cybersecurity incident involving the theft of patient data. Unauthorized individuals had access to its network between May 19, 2023, and May 21, 2023, during which time files were removed from its network.

The file review was completed on December 28, 2023, and individual notifications have now been mailed to the affected individuals. The types of information involved varied from individual to individual and may have included names in combination with one or more of the following: Social Security number, date of birth, driver’s license number, state identification number, passport number, alien registration number, financial account information, medical information (date(s) of service, treatment/diagnosis information, medical record number, patient account number, and/or prescription information) and/or health insurance policy information.

The Notification to the Maine Attorney General indicates 132,887 individuals were affected. The healthcare system said no evidence has been found to indicate any actual or attempted misuse of that data. As a precaution against identity theft and fraud, Complimentary credit monitoring services have been offered to individuals who had their Social Security numbers exposed. Columbus Regional Healthcare said it had implemented safeguards to protect against unauthorized access and continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal information.”

Senior PsychCare Notifies 75,000 Patients About December 2022 Data Breach

Texas-based Psychological Holdings, PLLC, which does business as Senior PsychCare (SPC), has notified 75,000 patients that some of their protected health information was exposed in a December 2022 security breach. According to the breach notification letters, unauthorized individuals had access to its network between December 13, 2022, and December 22, 2022.

Senior PsychCare engaged third-party cybersecurity professionals to conduct a forensic investigation which was followed by a manual review of all files on the parts of its network that were accessible to the attackers. That process was completed on November 20, 2023, and confirmed that the exposed information included names, addresses, Social Security numbers, medical information, and health insurance information.

Senior PsychCare said it is unaware of any actual or attempted misuse of patient data and has offered the affected individuals complimentary credit monitoring services as a precaution. SPC said it had cybersecurity measures in place to protect against unauthorized data access and continually evaluates and modifies its practices and internal controls to enhance the security and privacy of personal data.

Primary Health & Wellness Center Discloses October 2023 Ransomware Attack

Primary Health & Wellness Center in Baltimore County, MD, has recently notified 4,792 individuals that some of their protected health information was potentially compromised in a ransomware attack that was detected on October 20, 2023. According to the substitute breach notice, the affected server contained the medical records of patients from 2018 to present, which included names, addresses, dates of birth, Social Security numbers, and medical record data. The forensic investigation uncovered no evidence to indicate data was exfiltrated from the server before files were encrypted, and typically threat actors that use Phobos ransomware are not known to exfiltrate data. That said, it was not possible to totally rule out the possibility of data theft.

While data theft is not thought to have occurred, the affected patients have been advised to monitor their account statements and credit reports for potential fraudulent activity and to promptly report any suspected fraudulent activity to law enforcement. Primary Health & Wellness Center said it takes its responsibilities under HIPAA and the Maryland Confidentiality of Medical Records Act very seriously and genuinely apologizes for the incident and inconvenience caused.

PHI Compromised in Coastal Hospice & Palliative Care Cyberattack

Coastal Hospice & Palliative Care in Salisbury, MD, has recently announced that it suffered a cyberattack on July 24, 2023, that caused network disruption. Cybersecurity experts were engaged to investigate the incident and confirmed that its network had been accessed by unauthorized individuals. A review was conducted of all files on the network that had been exposed and may have been obtained by the attackers, and that process was completed on November 20, 2023. Notification letters were mailed to the affected individuals on January 22, 2023.

The information exposed and potentially stolen included names, Social Security numbers, dates of birth, medical diagnosis information, health insurance policy numbers, physician or medical facility information, medical condition or treatment information, and patient account numbers. The incident has been reported to the appropriate authorities, but it is not currently displayed on the HHS’ Office for Civil Rights breach portal, so it is unclear how many individuals were affected.

Aria Care Partners Discloses May 2023 Cyberattack

Aria Care Partners in Overland Park, KS, has recently disclosed a cybersecurity incident that occurred in May 2023. The forensic investigation confirmed there had been unauthorized access to its vision file server. A comprehensive review was conducted of all files on the server which was completed in December 2023 and confirmed that files had been exposed that contained patient names, dates of birth, Social Security numbers, driver’s license numbers, diagnosis, treatment information, and health insurance information.

Notification letters were mailed to the affected individuals on January 19, 2024, and the affected individuals have been offered complimentary credit monitoring and identity theft protection services, which include a $1 million identity theft insurance policy, dark web monitoring, and identity theft recovery services.

The incident has been reported to the appropriate authorities, but it is not currently displayed on the HHS’ Office for Civil Rights breach portal, so it is unclear how many individuals were affected.

The post Columbus Regional Healthcare System Reports 133K Record Data Breach appeared first on HIPAA Journal.

Data breaches have recently been reported by Meridian Behavioral Healthcare, Network 180, Erie VA Medical Center, and Fred Hutchinson Cancer Center.

Meridian Behavioral Healthcare

Meridian Behavioral Healthcare, Inc. in Florida has recently confirmed that protected health information was exposed in a security breach that was detected on August 11, 2023. Third-party cybersecurity specialists were engaged to investigate the breach and on December 4, 2023, confirmed that 98,808 individuals had been affected. Written notifications were mailed on December 22, 2023. The information exposed in the breach varied from individual to individual and may have included names, addresses, Social Security numbers, dates of birth, medical diagnosis and treatment information, health insurance information, and prescription information.

Meridian Behavioral Healthcare said it is not aware of any misuse of patient data but has offered the affected individual complimentary credit monitoring services. Additional security measures have been implemented within its network, and data security policies and procedures are being reviewed and will be updated to better protect patient data.

Network 180

The Kent County Community Mental Health Authority, which does business as Network 180, has notified 59,334 individuals about unauthorized access to their protected health information. A security breach was detected on October 18, 2023, and the attack was contained by the IT department the same day. Third-party cybersecurity experts were engaged to investigate the breach and confirmed on October 25, 2023, that the unauthorized activity stemmed from a phishing attack.

An employee clicked a malicious link in an email that directed them to a website where they were prompted to enter their credentials, which were captured by the attacker and used to access the employee’s email account. Network 180 said multi-factor authentication was enabled on the employee’s account; however, the MFA controls were bypassed in the attack. The threat actor was able to access the employee’s email account between September 28, 2023, and October 18, 2023, and during that time exported data from the account, including names, addresses, dates of birth, full or partial Social Security Numbers, health insurance policy information, medical information, other demographic information (i.e., race or gender), and in a limited number of cases, financial account or payment card numbers and/or driver’s license numbers.

Network 180 said it has taken several steps to improve the security of its Office 365 email accounts and has hired cybersecurity staff to proactively monitor its systems. The affected individuals have been notified and offered complimentary credit monitoring services for 12 months. Network 180 deserves credit for being transparent about the data breach and providing detailed information in its breach notice to the affected individuals.

Erie VA Medical Center

Erie VA Medical Center has apologized for an impermissible disclosure of patient data in mid-November. A printing error was made when sending appointment scheduling and appointment reminders to patients, which resulted in the reminders being sent to incorrect patients. The postcards only included information concerning the appointment and did not include sensitive or other identifying information. 2,380 veterans in Delaware, Kentucky, Maryland, New Jersey, New York, Ohio, Pennsylvania, Virginia, & West Virginia were affected. The postcards were sent to the correct recipients on November 16, 2023.

Fred Hutchinson Cancer Center

Fred Hutchinson Cancer Center has notified 544 patients that some of their sensitive data has potentially been exposed. Fred Hutch was notified on October 27, 2023, by a provider that their laptop computer had been lost while traveling. The laptop was used to access a Microsoft Outlook application through which patient information could be accessed. The provider said the laptop was password protected and has now been configured to initiate a remote wipe of the hard drive if it comes online. Fred Hutch conducted a review to find out what types of data were accessible through the laptop and determined that names, addresses, phone numbers, dates of birth, medical record numbers, patient account numbers, dates of service, and certain clinical information had been exposed, and for a limited number of patients, also Social Security numbers.

Notification letters were sent on December 26, 2023, and complimentary credit monitoring services have been made available to individuals who had their Social Security numbers exposed. Fred Hutch has provided additional education to the workforce on safeguarding mobile devices. This is the second data breach to be reported by Fred Hutchinson Cancer Center in the past few weeks. A much more serious breach occurred between November 19 and November 25, 2023, when a cybercriminal group breached its network and stole patient data. Fred Hutch has not yet confirmed how many patients have been affected but the hackers claimed to have infiltrated the data of around 800,000 patients. When the ransom was not paid, the threat actors started threatening patients directly.

The post Meridian Behavioral Healthcare Discloses 99,000-Record Data Breach appeared first on HIPAA Journal.