Covenant Healthcare in Saginaw, MI has discovered an unauthorized individual gained access to two employee email accounts that contained the protected health information of approximately 45,000 patients. The security breach was identified on December 21, 2020, with the investigation revealing the first email account was compromised on May 4, 2020.

A review of the compromised email accounts revealed they contained the following types of protected health information: Names, addresses, dates of birth, Social Security numbers, driver’s license numbers, medical diagnosis and clinical information, medical treatment information, prescription information, doctors’ names, medical record numbers, patient account numbers, and medical insurance information.

Affected individuals have been advised to place a fraud alert on their accounts and to monitor their account statements for signs of unauthorized activity. Affected individuals do not appear to have been offered complimentary credit monitoring.

“We are committed to keeping your personal information safe and pledge to continually evaluate and modify our practices and internal controls to enhance security and privacy,” explained Covenant Healthcare in its website breach notice.

Fisher-Titus Medical Center – Norwalk, Ohio

An unauthorized individual has gained access to the email account of an employee of Fisher-Titus Medical Center in Norwalk, OH. The email account was first accessed in August 2020 and access remained possible until October 2020 when the breach was discovered and the email account was secured.

The delay in issuing notifications to affected individuals was due to the time taken to investigate the breach. Third-party cybersecurity experts completed their investigation on January 13, 2020 and breach notification letters were sent on February 18, 2021.

The medical center determined the breach included patient names, medical information such as diagnoses, clinical information, health insurance information, Social Security numbers, and credit/debit card numbers. Affected individuals whose Social Security number was potentially compromised have been offered complimentary membership to credit monitoring services for 12 months.

Additional safeguards have now been implemented, including changes to the password policy, enhanced antivirus software, upgrades to external firewalls, and email retention policies have been revised and monitoring enhanced. A new anti-phishing platform has also been implemented.

University Hospital – Newark, New Jersey

University Hospital in Newark, NJ, has discovered an unauthorized individual gained access to its computer network and potentially viewed and exfiltrated patient information. The incident was detected on September 14, 2020, with the system found to have been breached four days previously.

A forensic investigation revealed the attacker potentially gained access to names, addresses, dates of birth, driver’s license numbers, Social Security numbers, state ID numbers, passport numbers, insurance information, financial information, medical record numbers, and some clinical information.

Affected individuals have been offered complimentary membership to identify theft protection and credit monitoring services for 12 months. University Hospital has since taken steps to improve its security protocols to prevent further breaches.

The post Email Security Breach Impacts 45,000 Covenant Healthcare Patients appeared first on HIPAA Journal.

St. Margaret’s Health –Spring Valley in Illinois is investigating a cyberattack that occurred over the weekend of February 20/21, 2021. The security breach was detected by the hospital’s IT team on February 21, and the hospital’s computer network and all web-based applications including email and its patient portal were shut down.

The hospital had security systems in place to protect against intrusions and data breaches. It is currently unclear how those systems were bypassed. Third-party cybersecurity experts have been engaged to assist with the investigation and remediation efforts.

St. Margaret’s Health had developed and practiced computer downtime emergency operations, which have been implemented and the hospital has temporarily reverted to paper records for recoding patient information and the hospital is relying on telephone and fax for communication while the email system is out of action. It is currently unclear for how long the systems will remain offline.

The cyberattack did not affected the computer systems of St. Margaret’s Peru, as those computer systems have not yet been merged with St. Margaret’s Spring Valley. Care continues to be provided to patients; however, diagnostic imaging procedures have been temporarily transferred to St. Margaret’s Peru while the security breach is remediated.

The breach investigation is still in the early stages, but no evidence has been found so far to suggest any patient information has been compromised.

COVID-19 Contact Tracing Data of Pitkin County, CO Residents Exposed Online

The personal information of 1,454 residents of Pitkin County in Colorado has been exposed online and could potentially have been accessed by unauthorized individuals. The exposure of the data was due to an error that occurred when configuring the county’s COVID-19 contact tracing system.

The types of information exposed includes names, dates of birth, employer information, date of onset of COVID-19 symptoms, date and type of COVID-19 test taken, the results of those tests, whether individuals have had a flu jab, information on school and childcare used by individuals, and whether individuals had any underlying health conditions. The information was exposed online between October 1, 2020 and December 14, 2020.

An error occurred when configuring the software used to upload the information to the website, which failed to prevent certain fields from being rendered inaccessible. While it is not possible to determine if any information was accessed by unauthorized individuals during the time it was accessible, the county suspects some people may have downloaded the information.

Pitkin Country is offering 12 free months of credit monitoring and identification restoration services to affected individuals.

Documents Containing PHI of HarborChase Nursing Home Residents Found Scattered in Florida Streets

Documents containing the protected health information of residents of the HarborChase senior living facility in Mandarin in Jacksonville, FL have been found scatters in streets in St. John’s County. First Coast News was alerted to the privacy breach by residents who discovered the paperwork, some of which contained sensitive information such as names, addresses, Social Security numbers, and prescription information.

Some of the information related to patients of Guardian pharmacy, which was alerted to the breach and subsequently notified HarborChase. According to a report on First Coast News, HarborChase is investigating a document shredding company it contracted to securely dispose of documents containing patient information. HarborChase said all of the documents had been sent for secure disposal.

The post Cyberattack Forces St. Margaret’s Health –Spring Valley to Shut Down Computer Systems appeared first on HIPAA Journal.

Kroger has announced it has suffered a data security incident involving the exploitation of SQL injection vulnerabilities in its Accellion File Transfer Appliance (FTA). The Accellion FTA is a legacy appliance that was released around 20 years ago as a secure file transfer solution for sharing files too large to send via email.

A zero-day vulnerability in the product was first identified by Accellion in mid-December 2020, with a further three vulnerabilities subsequently identified. Some of those vulnerabilities were exploited by a threat actor to gain access to the vulnerable devices. The hacker then installed a web shell which was used to exfiltrate sensitive data.

Accellion explained in a February 22, 2021 press release that Mandiant had investigated the security incident and attributed the attacks to a criminal hacker tracked as UNC2546. UNC2546 has been linked to the FIN11 hacking group and CL0P ransomware operation.

In January, several Accellion FTA customers reported receiving ransom demands for the return of stolen data. Threats were made to publish stolen data on the CL0P ransomware data leak site if the ransom was not paid. Accellion says around 300 customers use the Accellion FTA, fewer than 100 were victims of the attack, and fewer than 25 suffered significant data theft. Ransomware was not used in the attacks.

Kroger was alerted to the breach on January 23, 2021 and discontinued use of the Accellion FTA. An internal investigation was conducted to determine which information had potentially been stolen. Kroger said fewer than 1% of its customers were affected, most of whom were customers of Kroger Health and Money Services, along with some associates and employees.

Some Social Security numbers were compromised but the breach did not include financial information or customer account passwords, and there have been no reports of the misuse of any customer data. Kroger has offered complimentary credit monitoring services to all affected customers.

The incident has yet to be reported to the HHS’ Office for Civil Rights so it is currently unclear how many patients have been affected.

The post Exploitation of Vulnerabilities in Accellion File Transfer Appliance Gave Hackers Access to Data of Kroger Customers appeared first on HIPAA Journal.

The protected health information of 29,982 patients of a Laguna Hills, CA-based provider of medical and surgical eye care services has potentially been stolen in a cyberattack on its online storage vendor.

On January 15, 2021, Harvard Eye Associates was informed by its storage vendor that hackers had gained access to the vendor’s computer system and exfiltrated data. It is not clear whether files were encrypted to prevent access; however, a ransom demand was issued for the return of the stolen data. The storage vendor consulted with cybersecurity experts and the Federal Bureau of Investigation and took the decision to pay the ransom demand.

The hackers returned the stolen data and provided assurances that no copies of the data had been made and there had been no further disclosures of the stolen information. The cybersecurity experts engaged by the security vendor have been monitoring the Internet and darknet and have not found any evidence to suggest the stolen data has been sold or leaked online. An investigation into the breach revealed the hackers first gained access to its computer systems on October 24, 2020.

The types of patient information potentially obtained by the hackers included patients’ names, addresses, phone numbers, email addresses, dates of birth, medical histories, health insurance information, medications, and information about treatment provided at Harvard Eye Associates.

Harvard Eye Associates provides billing and other administrative services to Alicia Surgery Center in Laguna Hills, which requires access to the types of data previously mentioned. Alicia Surgery Center patients were also affected by the security incident. It is currently unclear how many patients of Alicia Surgery Center have been affected.

Harvard Eye Associates and Alicia Surgery Center explained in their website breach notices that affected individuals are being notified and offered complimentary credit monitoring and identity theft protection services.

The post Ransom Paid to Recover Healthcare Data Stolen in Cyberattack on Online Storage Vendor appeared first on HIPAA Journal.

Grand River Medical Group in Dubuque, OH has discovered an unauthorized individual gained access to the email account of an employee and may have viewed or obtained the protected health information of 34,000 patients.

Upon discovery of the breach, a password reset was performed to prevent any further unauthorized access and an internal investigation was launched to determine whether any other systems were breached. The Grand River Medical Group IT team confirmed that only one email account was compromised and no other systems were accessed.

Third-party breach response experts were engaged to conduct a forensic analysis to determine whether any patient information in the email account was viewed or exfiltrated. It was not possible to rule out data theft, although no evidence was found to indicate patient data was stolen in the attack.

The information in the email account varied from patient to patient and included one or more of the following types of protected health information in addition to patient names: Address, date of birth, patient’s balance and balance type, visit type, claim amount and status code, medications, and guarantor’s name. Some Social Security numbers were also exposed.

Notifications were sent to affected patients between February 8 and February 11, 2021. Affected individuals have been offered a complimentary 12-month membership to credit monitoring and identity theft recovery services through MyIDCare, which includes a $1,000,000 identity theft insurance policy.

PHI of 15,600 Patients Potentially Compromised in Granite Wellness Centers Ransomware Attack

Granite Wellness Centers in Northern California suffered a ransomware attack on January 5, 2021 in which patient information was encrypted. The attack was detected while it was in progress and systems were taken offline to prevent the exfiltration of data.

A ransom remand was issued, but no ransom was paid. Granite Wellness Centers was able to restore all encrypted files from backups. A review of the systems affected revealed they contained patient data such as names, dates of birth, dates of service, treatment and health information, treatment provider, and health insurer name.

Granite Wellness Centers has not received any reports that indicate patient information has been misused; however, affected individuals have been advised to monitor their accounts and explanation of benefits statements for suspicious activity. Additional safeguards are being implemented to prevent further cyberattacks and to secure data stored on its systems.

The PHI of up to 15,600 individuals was potentially compromised in the attack.

Texas Spine Consultants Security Breach Impacts 25,728 Patients

Texas Spine Consultants in Addison, TX has discovered a security incident which resulted in the inadvertent disclosure of the protected health information of 25,728 patients. The security incident occurred on December 2, 2020 and is still under investigation, but it does not appear that the disclosure was linked to hackers or criminal activity.

The information inadvertently disclosed was limited to patients’ names, dates of birth, and image scans. Texas Spine Consultants has notified affected individuals by mail and has provided information to help them protect themselves against fraudulent activity. Additional privacy and security measures have now been implemented to prevent further data breaches in the future.

Southern California Center for Anti-Aging Discovers Email Account Breach

The Southern California Center for Anti-Aging in Torrance, CA has discovered an unauthorized individual gained access to an employee’s email account and may have viewed or downloaded patient information.

The breach was detected on December 9, 2020 and access to the email account was immediately blocked. A review of the compromised account revealed it contained patient names along with limited clinical information about the care provided at the Southern California Center for Anti-Aging.

The Southern California Center for Anti-Aging has implemented additional security measures to prevent further breaches in the future and all affected individuals have been notified by mail.

PHI Potentially Obtained in Gastroenterology Consultants Hacking Incident

Gastroenterology Consultants in Reno, NV is notifying 2,500 patients about a data security incident that occurred on December 8, 2020. A hacker gained access to a server and potentially obtained files containing patient names, addresses, contact telephone numbers, and other personally identifiable information.

A forensic investigation was conducted by a third-party security firm and it appears that files were exfiltrated from the server. Additional cybersecurity measures have now been implemented to prevent further breaches in the future.

The post Grand River Medical Group Email Breach Impacts 34,000 Patients appeared first on HIPAA Journal.

Two more healthcare providers have suffered ransomware attacks in which sensitive information was exfiltrated and leaked online when the ransom was not paid.

The Conti ransomware gang has published data on its leak site which was allegedly obtained in an attack on Rehoboth McKinley Christian Health Care Services in New Mexico. The leaked data includes sensitive patient information including scanned patient ID cards, passports, driver’s license numbers, diagnoses, treatment information, and diagnostic reports.

It is unclear how many patients have had their PHI exposed so far. The Conti ransomware gang claims it has only published around 2% of the data stolen in the attack.

The latest data leak by the Conti ransomware gang follows similar leaks of the data stolen in the ransomware attacks on Leon Medical Centers in Florida and Nocona General Hospital in Texas.

The Avaddon ransomware gang has similarly published data on its leak site that was stolen in an attack on Capital Medical Center in Olympia in Washington. The gang has threatened to leak further data within the next few days if the ransom is not paid. The leaked data includes driver’s license numbers, patient documents, diagnosis and treatment information, insurance information, lab test results, prescriptions, provider names, and patient contact information.

According to Emsisoft, there are currently at least 17 ransomware gangs engaging in data exfiltration prior to file encryption, all of which threaten to release or sell the stolen data if the ransom is not paid.  The latest Coveware ransomware report suggests data exfiltration occurs in around 70% of ransomware attacks. These double extortion attacks often see the ransom paid to prevent the release of stolen data, but there are signs that this tactic is becoming less effective due to a lack of trust that the threat groups will delete stolen data if the ransom is paid.

There have been several cases where payment has been made, only for further extortion demands to be made or for stolen data to still be published on leak sites.

Hacker Potentially Obtained Patient Data from Sutter Buttes Imaging Medical Group

Sutter Buttes Imaging Medical Group (SBIMG) in Yuba City, CA has discovered an unauthorized individual has gained access to third -party IT hardware used at its Yuba City imaging center and potentially viewed and obtained limited patient data.

In December 2020, SBIMG learned that a hacker exploited an unpatched vulnerability in IT hardware that was used to store and transmit information in connection with medical services provided to patients. Action was immediately taken to expel the hacker from its systems and secure patient data. An investigation into the incident revealed the hacker first gained access to the IT hardware in July 2019, and access remained possible until December 2020.

An investigation into the security breach showed the attacker had access to limited patient information such as names, dates of birth, imaging procedure performed, study date, study name, and internal patient/study numbers. No financial information, insurance information, or Social Security numbers were compromised.

SBIMG has corrected the vulnerability and other steps have been taken to improve security to prevent similar breaches in the future, including closing certain firewall ports. Third-party security experts have been engaged to assess system security and additional security controls are now being implemented.

All patients have been notified by mail and the breach has been reported to the HHS’ Office for Civil Rights. The incident has yet to appear on the HHS breach portal, so it is currently unclear exactly how many individuals have been affected.

The post Ransomware Gangs Leak Sensitive Data Stolen from Capital Medical Center and Rehoboth McKinley Christian Health Care Services appeared first on HIPAA Journal.