On January 12, 2021, Denver-based Colorado Retina Associates discovered the email account of one of its employees had been accessed by an unauthorized individual who used it to send phishing emails to individuals in the employee’s contact list. The email account was immediately secured and a cybersecurity firm was engaged to investigate the incident to determine the extent of the breach.

That investigation concluded on February 24, 2021 and revealed other email accounts had also been compromised, two of which contained patients’ protected health information. The nature of the attack meant that between January 6, 2021 and January 17, 2021, synching may have occurred. That means the contents of the email accounts may have been copied to the attacker’s device.

A comprehensive review of the email accounts was performed which revealed the protected health information of 26,609 individuals was stored in the accounts. The types of PHI varied from individual to individual may have included full names, date of birth, home addresses, phone numbers, email addresses, dates of service, diagnoses and conditions, labs and diagnostic studies, medications, other treatment or procedure information, and certain health insurance, claims, billing, and payment information.

Fewer than 3% of affected individuals had their Social Security exposed, and fewer than 0.2% of individuals had their driver’s license, financial account, or payment card information exposed.

A password reset was performed across the entire email system and changes have been made to how authorized individuals access email accounts. Security awareness has also been reinforced across the entire workforce.

Affected individuals have now been notified and have been offered 12 months of identity theft protection services.

Walmart Discovers PHI of 2,067 Customers Potentially Compromised in Vendor Breach

On February 16, 2021, Walmart was notified by one of its suppliers about a security incident that may have involved the protected health information of Walmart customers.

The supplier used a data hosting service which was compromised on January 20, 2021. The attackers stole records related to 2,067 Walmart pharmacy customers which included information such as names, dates of birth, addresses, telephone numbers, medication information, prescription numbers, prescriber information, prescription dates, and a very small number of health insurance subscriber ID numbers.

The supplier said it immediately stopped using the data hosting service once it became aware of the breach. Walmart said it is reviewing the security practices of its supplier and will be monitoring the circumstances surrounding the data security event.

The post PHI of 26,600 Individuals Potentially Copied in Colorado Retina Associates Phishing Attack appeared first on HIPAA Journal.

The Portland, OR-based technology and communication solution provider Metro Presort suffered a ransomware attack on May 6, 2019 which resulted in the encryption of files and locked staff out of its systems. The ransomware attack was promptly identified and was contained by May 15, 2019 and the company was able to recover from the attack relatively quickly. An investigation into the attack found no evidence to suggest files were removed from its system, and since the company already encrypted customer data, the attackers would not have been able to access any sensitive information.

In October 2020, Metro Presort reinvestigated the attack and the secondary investigation was unable to confirm that files containing customer data were definitely encrypted before the attack. The invoices, statements, and spreadsheets that Metro presort processed for clients, including healthcare organizations, could potentially have been accessed. An analysis of those files confirmed they contained patient names, addresses, dates of birth, patient and health plan IDs or account numbers, appointment dates, treatment dates, and diagnoses and treatment codes, according to a substitute breach notice published on the Metro Presort website on November 24, 2020.

The incident has recently appeared on the HHS’ Office for Civil Rights website stating the PHI of up to 38,387 individuals may have been compromised. Metro Presort explained in its breach notice that the Department of Health and Human Services’ Office for Civil Rights investigated the breach, Metro Presort’s response, and its policies and procedures, and closed the case on December 31, 2020 after confirming no HIPAA violations had occurred.

“Both before and since this incident, MPI and has devoted considerable resources to maintaining and enhancing its data security, including implementation of the latest technical safeguards to prevent similar incidents, additional protections (encryption) of customer files, and security audits,” explained Metro Presort in its breach notice.

The post Reinvestigation of 2019 Metro Presort Ransomware Attack Reveals PHI May Have Been Compromised appeared first on HIPAA Journal.

PeakTPA, a St. Louis, MO-based provider of health plan management and back-office services, has announced it suffered a cyberattack on or around December 28, 2020 in which protected health information was stolen.

The security incident was detected on December 31 and involved two cloud servers used by the company to manage program of all-inclusive care for the Elderly (PACE) claims.  According to the breach report submitted to the HHS’ Office for Civil Rights, the PHI of up to 50,000 individuals was stolen or exposed.

An investigation into the attack confirmed the attackers obtained full names, home addresses, dates of birth, Social Security numbers, PACE program IDs, and diagnosis and treatment information.

Affected individuals have been notified and offered complimentary membership to credit monitoring, fraud consultation, and identity theft restoration services via Kroll.

St. Bernard’s Total Life Healthcare, Inc., which provides PACE in Northeast Arkansas, and Rocky Mountain Health Care Services in Colorado Springs have confirmed that their patients have been impacted by the attack.

92,000 Individuals Affected by Preferred Home Care of New York Ransomware Attack

Preferred Home Care of New York, a Brooklyn, NY-based provider of in-home care services, experienced a ransomware attack on January 8, 2020 in which patient data was stolen. The attack was detected the following day. According to databreaches.net, samples of data stolen in the attack were uploaded to the Sodinokibi (REvil) data leak site in January.

External counsel for Preferred Home Care of New York explained in a data breach notification that the types of data obtained by the gang varied from individual to individual and may have included names, addresses, email addresses, phone numbers, dates of birth, financial information such as bank account numbers, Social Security numbers and medical information related to health assessments, physicals, drug screens, vaccinations, and TB tests, as well as FMLA and worker’s compensation claims.

92,283 individuals have been notified and complimentary credit monitoring and identity theft protection services have been offered to breach victims.

Newberry County Memorial Hospital Suffers Ransomware Attack

Newberry County Memorial Hospital in South Carolina has announced it suffered a ransomware attack in February that took certain servers out of action, forcing the hospital to switch to manual procedures while the attack was mitigated. The hospital had a full backup of its data and systems and was able to restore all encrypted data without paying the ransom.

The investigation into the attack is ongoing and no evidence has been found of unauthorized data access or data exfiltration to date. The hospital has since taken steps to improve security to prevent similar attacks in the future.

The post Ransomware Gangs Claim Three More Healthcare Victims appeared first on HIPAA Journal.

Premier Diagnostics, a Utah-based COVID-19 testing service, has inadvertently exposed the protected health information of tens of thousands of individuals.

Two Exposed Amazon S3 buckets were discovered by Bob Diachenko of Comparitech on February 22, 2021. It was not initially clear who owned the data, which related to patients from Utah, Nevada, and Colorado. The S3 buckets were eventually traced to Premier Diagnostics.

The S3 buckets contained two databases, one of which included around 200,000 images of scans of ID cards such as driver’s licenses, passports, state ID cards, medical insurance cards, and other IDs documents. The databases had been indexed by search engines and could be accessed over the Internet without a password.

Premier Diagnostics was determined to be the probable owner of the data on February 25, 2020 and attempts were made to contact the company. Contact was finally made on March 1, 2021 and the databases were secured the same day.

It is unclear whether the databases were found and downloaded by any individuals other then Diachenko in the week or more that the databases were accessible over the Internet. Premier Diagnostics confirmed to Comparitech that each individual had four scans: Two scans of a health insurance card and two scans of an ID document, so the IDs and insurance information of approximately 52,000 individuals were exposed. The ID cards included an individual’s name, age, address, gender, ID number, and their photo.

The second exposed Amazon S3 bucket contained a database that included the names, dates of birth, and test sample IDs from individuals who underwent a COVID-19 test, although the database did not include the test result. “Each of the 3,645 items in the bucket is a scanned table with dozens of patients,” explained Comparitech.

Nefilim Ransomware Gang Publishes Data Stolen from Atlanta Allergy & Asthma

Databreaches.net has reported Atlanta Allergy & Asthma in Georgia is one of the latest victims of the Nefilim ransomware gang, which recently published sensitive data on its dark web leak site that was stolen prior to the encryption of files. A 1.3 GB compressed archive was uploaded to the leak site that contained 597 files containing 2.5 GB of data.

The dumped data is a sample of an alleged 19GB of data stolen in the attack, with the Nefilim actors threatening to publish the remaining data if the ransom is not paid. The published data includes billing documents and patient audits that include highly sensitive personal, medical, and insurance information.

The incident has yet to appear on the HHS’ Office for Civil Rights website and the breach does not appear to have been announced by Atlanta Allergy & Asthma so it is currently unclear how many individuals have been affected.

Ransomware Gang Demanded $1.75 Million Payment from Allergy Partners of Western North Carolina

The Federal Bureau of Investigation (FBI) is investigating a February 23, 2021 ransomware attack on Allergy Partners of Western North Carolina that took its IT systems out of action for several days. As a result of the attack, the allergy center was unable to provide allergy shots to patients at its offices in Asheville and Arden. Normal services for patients resumed on March 1 at most of its locations.

According to a report filed with the police department, the attackers demand a ransom payment of $1.75 million for the keys to decrypt files.  Its IT department has been working round the clock to restore files and systems and third-party cybersecurity firms have been engaged to investigate the breach and determine if patient information was accessed or obtained by the attackers.

The post Unsecured Amazon S3 Buckets Contained ID Card Scans of 52,000 Individuals appeared first on HIPAA Journal.

New London Hospital in central New Hampshire has discovered an unauthorized individual gained access to a file on its network in July 2020 and may have obtained the protected health information of 34,878 patients. A third-party cybersecurity firm was engaged to assist with the investigation and determined on February 16, 2021 that the file was accessed for a short period and may have been copied.

The file contained patient names, limited demographic information, and Social Security numbers; however, no diagnosis, treatment, or hospitalization information was compromised. New London Hospital is unaware of any misuse of information contained in the file. The network system on which the file was stored is no longer used by the hospital.

Additional safeguards have now been implemented to prevent similar breaches in the future. All patients have been notified and offered complimentary credit monitoring and identity theft protection services.

Child Focus Reports Malware Infection and 2,700-Record Data Breach

Child Focus, a Cincinnati, OH-based nonprofit that provides support to children and their families through early learning, behavioral health and foster care programs, has announced its systems have been hacked and malware deployed, which may have allowed the hackers to access sensitive patient information.

After discovering a potential breach of its core IT systems, third-party cybersecurity specialists were engaged to investigate the incident and determine the nature and scope of the breach. The electronic health record system and application database were not affected; however, Child Focus was informed on January 5, 2021 that the attackers may have been able to view the protected health information of 2,716 individuals, including names, dates of birth, Social Security numbers, health and treatment-related information, and state Medicaid numbers.

Affected individuals have been notified and offered complimentary credit monitoring and identity theft protection services. Child Focus has also taken steps to improve system security, including implementing enhanced controls for remote access to its systems and advanced endpoint detection and response software on all endpoints and workstations.

Orlando Health South Lake Hospital Loses Logs Books Containing PHI of 1,623 Patients

Orlando Health South Lake Hospital has discovered logbooks used for recording patients’ hospital visits have been lost or stolen. The logbooks were discovered to be missing between December 24 and December 28, 2020. An extensive search was conducted, but the logbooks could not be located.

Hospital staff used the logbooks for recording information about obstetrics patients which included information such as patient names, dates of birth, medical record numbers, hospital account numbers, dates of service, attending physician, chief complaint, and/or internal hospital service codes. The data related to 1,673 patients who received care between April 20, 2019 and December 23, 2020.

The logbooks were kept in an area of the hospital that was not open to the public, so the hospital does not believe the logbooks have left the facility. Internal policies and procedures are being reviewed and will be revised, as necessary, to improve information security and the hospital is considering other more secure methods of recording patient data.

The post New London Hospital Data Breach Affects Almost 35,000 Patients appeared first on HIPAA Journal.