The number of victims reporting being impacted by the Blackbaud ransomware attack and data breach has continued to grow over the past few weeks, with the Department of Health and Human Services’ Office for Civil Rights breach portal continuing to list healthcare victims. Recent additions include Moffitt Cancer Center, OSF HealthCare System, and Geisinger, with those three entities reporting the incident as affecting a total of 276,600 individuals.

While the total number of victims has not been disclosed by Blackbaud, at least 250 healthcare organizations, non-profits, and educational institutions are known to have been impacted, with healthcare organizations reporting the breach as affecting more than 10 million individuals.

Unsurprisingly given the breach costs incurred by organizations and the number of individuals whose personal information has been exposed, Blackbaud is facing many class action lawsuits. At least 23 proposed class action lawsuits have been filed so far in the United States and Canada, according to its 2020 Q3 Quarterly Report filed with the U.S. Securities and Exchange Commission (SEC). 17 of those lawsuits were filed in federal court in the United States, 4 in state courts, and 2 in Canadian courts.

The lawsuits allege victims have suffered harm as a result of the breach and allege violations of several laws, with the lawsuits seeking damages, injunctive relief, and attorneys’ fees, and around 160 claims have been received from Blackbaud’s customers in the U.S, Canada, and United Kingdom.

In addition to the lawsuits, Blackbaud is being investigated by regulators over violations of data privacy laws, including the Department of Health and Human Services, the Federal Trade Commission, and internationally by the UK’s Information Commissioner’s Office and the Office of the Privacy Commissioner of Canada. A joint investigation has also been launched by 43 state attorneys general and the District of Columbia.

According the SEC filing, Blackbaud has already incurred costs in excess of $3.2 million dealing with the cyberattack between July and September 2020, and $3.6 million in costs over the previous 9 months. That figure is offset by $2.9 million accrued in insurance recoveries between July and September.

Costs will continue to be accrued in the response to the breach and while those costs are likely to be considerable, Blackbaud expects its cyber insurance policies to cover the bulk of the costs of the breach.

“We have good insurance in place – our insurers are working with us very closely. The key there is coordinating with them and make sure we’re clear on what they’re covering or not going to cover,” said Blackbaud’s chief financial officer Anthony Boor in an October 30, 2020 call with financial analysts.

While the cyber insurance policies have already covered some of the costs, there is no guarantee that all costs will be covered by those policies. “Lawsuits that are putative class actions require a plaintiff to satisfy a number of procedural requirements before proceeding to trial,” explained Boor. “As a result of these uncertainties, we may be unable to determine the probability of loss until, or after, a court has finally determined that a plaintiff has satisfied the applicable class action procedural requirements.”

In the call with financial analysts, Blackbaud explained that the forensic investigation revealed exactly how the hackers succeeded in gaining access to its systems. The flaw exploited in the attack was present in one of its early generation products which has since been fixed and steps have already been taken to harden security. Blackbaud also explained that millions of dollars had been invested in cybersecurity and personnel prior to the breach in preparation for such an attack.

Blackbaud managed to contain the attack but was not able to prevent the exfiltration of some customer data. The ransom was paid to prevent publication of the data and Blackbaud believes the payment has prevented any further disclosures of data.

“We have no reason to believe that any data went beyond the cybercriminal, was or will be misused, or will be disseminated or otherwise made available publicly,” explained Blackbaud in the SEC filing.

The post Blackbaud SEC Filing Provides Further Information on Data Breach and Mitigation Costs appeared first on HIPAA Journal.

Redwood City, CA-based Ascend Clinical, a provider of ESRD laboratory testing for independent dialysis providers, has announced it suffered a phishing attack that led to a ransomware attack in May 2020.

Unusual system activity and file encryption were detected on or around May 31, 2020. Prompt action was taken to isolate the affected systems and an investigation was launched to determine the nature and scope of the incident. Assisted by a third-party security firm, Ascend Clinical determined access to its systems was gained when an employee responded to a phishing email.

Prior to the use of ransomware, the attackers accessed files that contained names, dates of birth, mailing addresses, and Social Security numbers. Steps have since been taken to strengthen its email security defenses to prevent similar attacks in the future.

The breach report submitted to the HHS’ Office for Civil Rights indicates 77,443 individuals were affected by the incident.

Alamance Skin Center Suffers Ransomware Attack

The Greensboro-based health system, Cone Health, has suffered a ransomware attack that affected the Alamance Skin Center in Burlington, NC.

The ransomware attack was limited to the single practice and occurred in late July 2020 and is believed to have started with a phishing attack or brute force attempt to obtain credentials. Prompt action was taken to isolate the impacted systems and third-party computer forensics experts were retained to assess the scope of the breach. The investigation did not find any evidence to suggest patient information was stolen prior to the encryption of files and no reports have been received that indicate patient information has been misused.

However, some patient information was encrypted in the attack and is unrecoverable. Cone Health reports the protected health information affected was limited to patient names, medical record numbers, dates of birth, diagnosis information, addresses, and date(s) of service.

The attack affected the appointments system, which is not accessible. Patients with appointment have been advised to contact the practice to confirm their appointment. Since it was not possible to determine with 100% certainty that patient information was not accessed by the attackers, all affected patients have been advised to be vigilant against incidents of identity theft and fraud.

Alamance Skin Center is reviewing existing policies and procedures and will be implementing additional safeguards to prevent similar incidents in the future.

Perry County Memorial Hospital Discovers Email Security Breach

Perry County Memorial Hospital in Tell City, IN has discovered the email accounts of two employees have been accessed by unauthorized individuals.

An investigation was launched which revealed the accounts were accessed on August 23, 2020. A review of the compromised accounts confirmed they contained private patient data which could have been viewed or obtained by the attackers, although no evidence of data theft was identified.

The information potentially compromised was limited to names, dates of birth, diagnoses/diagnostic codes, internal patient account numbers, provider names, and other health information, along with a limited number of Social Security numbers, Medicare/Medicaid numbers, and health insurance information.

Perry County Memorial Hospital is taking steps to enhance email security to prevent similar breaches in the future. Individuals whose Social Security number was potentially compromised have been offered complimentary membership to identity theft monitoring services.

BryLin Behavioral Health Notifies Patients About Potential PHI Breach

BryLin Behavioral Health System, a provider of mental health and addiction treatment services in Buffalo, NY, is alerting certain patients that some of their protected health information was potentially compromised as a result of a cybersecurity incident that occurred in August 2020.

Unusual network activity was detected by BryLin on August 19, 2020. Immediate action was taken to secure the network and an investigation was launched which revealed its systems had been compromised on August 14, 2020. Unauthorized individuals potentially accessed documents on the compromised systems that contained patient names, dates of birth, addresses, treatment information and/or clinical information and, in some instances, patients’ Social Security numbers and/or health insurance information. The breach only affected data of patients who received medical services at BryLin hospital. Patient information from its outpatient clinic, outpatient substance use, and outpatient mental health care services was not affected.

All patients affected by the breach have now been notified and the 75 patients who had their Social Security number exposed have been offered complimentary credit monitoring services.

It is currently unclear how many individuals have been affected by the breach.

The post Ascend Clinical and Alamance Skin Center Suffer Ransomware Attacks appeared first on HIPAA Journal.

Four email-related data breaches have recently been reported by U.S healthcare providers, along with an unspecified cyberattack on a mental health and addiction treatment provider.

12,000 Patients Impacted by Email Breach at Arkansas Otolaryngology Center

Little Rock, AR-based Arkansas Otolaryngology Center is alerting 12,000 patients about an email security breach discovered on July 17, 2020. An unauthorized individual was discovered to have gained access to the email account of an employee and was using the account to send unauthorized messages.

Assisted by a third-party computer forensics company, Arkansas Otolaryngology Center determined that four email accounts had been compromised between July 17, 2020 and July 27, 2020. It was not possible to determine whether any emails in the accounts had been subjected to unauthorized access during the time the accounts were accessible.

A review of emails and email attachments in the compromised accounts revealed they contained the following types of protected health information: names, dates of birth, medical record numbers, Social Security numbers, diagnoses, doctors’ names, driver’s license numbers, state identification card numbers, insurance group numbers, treatment locations, and treatment or procedure types or codes. A limited number of individuals also had financial account information exposed.

Upon discovery of the breach a full password reset was performed, and additional technical safeguards have since been implemented to prevent further email breaches. Individuals affected by the breach have been offered complimentary credit monitoring services.

Centerstone of Indiana Email Breach Impacts 11,638 Patients

Centerstone of Indiana, a provider of mental health and substance use disorder treatment services in Indiana, Illinois, Tennessee, and Florida, has discovered an employee’s email account has been accessed by an unauthorized individual.

Unusual activity was detected in the email account and it was immediately secured. The investigation revealed the email account had been accessed between December 12, 2019 and December 16, 2019; however, it took until August 25, 2020 for the investigation to confirm that protected health information was contained within the account.

The protected health information of 11,638 patients was exposed in the incident, including names, dates of birth, Social Security numbers, driver’s license numbers, state identification card numbers, medical diagnoses, treatment information, Medicaid and Medicare information, and health insurance information. The types of exposed data varied from patient to patient. Some employee information was also potentially compromised.

Notification letters were sent to affected patients on Thursday, October 22, 2020 and information has been provided on the steps that should be taken to reduce the risk of misuse of their data.

Centerstone reports that $800,000 has been invested on IT security infrastructure following the breach, including new software applications and security appliances. A security audit and gap assessment are being conducted by third-party security experts to identify any other areas where security can be improved. Policies and procedures are also being reassessed and further training on IT security has been provided to the workforce.

Perry County Memorial Hospital Discovers Email Security Breach

Perry County Memorial Hospital in Tell City, IN has discovered the email accounts of two employees have been accessed by unauthorized individuals.

An investigation was launched which revealed the accounts were accessed on August 23, 2020. A review of the compromised accounts confirmed they contained private patient data which could have been viewed or obtained by the attackers, although no evidence of data theft was identified.

The information potentially compromised was limited to names, dates of birth, diagnoses/diagnostic codes, internal patient account numbers, provider names, and other health information, along with a limited number of Social Security numbers, Medicare/Medicaid numbers, and health insurance information.

Perry County Memorial Hospital is taking steps to enhance email security to prevent similar breaches in the future. Individuals whose Social Security number was potentially compromised have been offered complimentary membership to identity theft monitoring services.

Tri-State Specialists Alerts 17,500 Patients About Email Error

Tri-State Specialists, a network of orthopedic surgery clinics serving residents in Iowa, South Dakota, and Nebraska, is alerting 17,050 patients about an incident that resulted in the impermissible disclosure of names and email addresses to a small number of current and former patients.

On September 16, 2020, Tri-State Specialists discovered an email had been sent by an employee that included patients’ names and email addresses in an attached file. No other patient information was included in the file. Patients have been advised to be vigilant for spam messages as a result of the disclosure of their email addresses.

In response to the breach, Tri-State Specialists have revised policies and procedures related to the sending of emails to prevent similar breaches in the future and the importance of data privacy has been re-emphasized with the workforce.

BryLin Behavioral Health Notifies Patients About Potential PHI Breach

BryLin Behavioral Health System, a provider of mental health and addiction treatment services in Buffalo, NY, is alerting certain patients that some of their protected health information was potentially compromised as a result of a cybersecurity incident that occurred in August 2020.

Unusual network activity was detected by BryLin on August 19, 2020. Immediate action was taken to secure the network and an investigation was launched which revealed its systems had been compromised on August 14, 2020. Unauthorized individuals potentially accessed documents on the compromised systems that contained patient names, dates of birth, addresses, treatment information and/or clinical information and, in some instances, patients’ Social Security numbers and/or health insurance information. The breach only affected data of patients who received medical services at BryLin hospital. Patient information from its outpatient clinic, outpatient substance use, and outpatient mental health care services was not affected.

All patients affected by the breach have now been notified and the 75 patients who had their Social Security number exposed have been offered complimentary credit monitoring services.

It is currently unclear how many individuals have been affected by the breach.

The post Email Incidents Result in the Potential Disclosure of the PHI of More Than 41,000 Patients appeared first on HIPAA Journal.

Two more hospitals have experienced ransomware attacks that have taken their computer systems offline and have forced clinicians to switch to pen and paper to record patient information.

Both ransomware attacks occurred on Tuesday, October 27, 2020, one on Sky Lakes Medical Center in Klamath Falls, OR and the other on St. Lawrence Health System in New York. It is unclear what ransomware variant was used in the attack on Sky Lakes Medical Center at this stage, but the St. Lawrence Health System ransomware involved a new variant of Ryuk ransomware.

Sky Lakes Medical Center announced on Facebook that while its computer systems had been taken out of action, care continued to be provided to patients and its emergency and urgent care departments remained open and fully operational and most scheduled elective procedures were continuing as planned. At this stage, no evidence has been found to indicate any patient data were compromised in the attack; however, the investigation is still in the early stages.

The attack on St. Lawrence Health System was detected several hours after the initial compromise. St. Lawrence Health System issued a statement saying its IT department had taken systems offline in an effort to contain the attack and prevent the ransomware from spreading to all parts of the network.

The ransomware attack is reported to have affected three of its hospitals – Canton-Potsdam Hospital, Gouverneur Hospital, and Massena Hospital. The decision was taken to divert ambulances from some of the affected hospitals as a precautionary step to ensure care could be provided to patients.

As with the attack on Sky Lakes Medical Center, no evidence has been found to indicate patient information was compromised, although the Ryuk ransomware gang is known to exfiltrate patient data prior to file encryption.

A joint advisory was issued by CISA and the FBI this week, in conjunction with the HHS’ Department of Health and Human Services, warning about an increase in targeted Ryuk ransomware attacks on hospitals and public health sector organizations. Credible evidence had been uncovered suggesting attacks on hospitals and other healthcare providers would likely increase.

Healthcare organizations are being advised to take steps to secure their networks from attacks. Indicators of compromise have been published along with mitigation measures to help prevent attacks and identify attacks in progress. Further information on the advisory along with the steps that should be taken to harden defenses can be found here.

The post Sky Lakes Medical Center and St. Lawrence Health System Attacked with Ransomware appeared first on HIPAA Journal.

Sonoma Valley Hospital in California experienced a computer security incident on October 11, 2020 which took its computer systems offline and caused “a significant downtime event.”

The hospital implemented its business continuity plan which allowed care to continue to be provided to patients while its computer systems were out of action. Throughout the incident its emergency department remained available and elective and necessary surgeries continued to be performed. The majority of diagnostic services continued without interruption, although the incident did cause disruption for some patients. The patient portal has remained available throughout, although new results have not been posted since October 11.

An investigation into the incident was immediately launched and third-party cybersecurity experts were engaged to assist with the investigation and recovery efforts. No information on the exact cause of the incident have been released to date, including whether ransomware was involved, and it is not yet known if any patient data was compromised.

Lycoming-Clinton Joinder Board Uncovers Further Data Breach

Lycoming-Clinton Joinder Board (LCJB), which runs programs providing services to individuals with mental illness or intellectual disabilities in Lycoming and Clinton Counties in Pennsylvania, is alerting 14,500 patients that some of their protected health information has potentially been compromised.

On August 10, 2020, while investigating an earlier data breach, LCJB discovered the email accounts of three employees had been accessed by an unauthorized individual. An analysis of the email accounts confirmed they contained patient information, but it was not possible to determine if any information in the accounts had been viewed or obtained by unauthorized individuals.

Information in the accounts varied from patient to patient and may have included names, addresses, dates of birth, medical record numbers, health insurance numbers, medical histories (including diagnoses, substance abuse, lab tests and results, mental or physical health evaluations, and treatment or provider information), costs of care, or circumstances of abuse. A limited number of Social Security numbers were also exposed.

The investigation confirmed the three email accounts were intermittently accessed by an unauthorized individual between August 5, 2020 and August 10, 2020. The earlier breach, which was discovered on June 23, 2020, was also an email security incident, which affected two employee email accounts. Those accounts were accessed by an unauthorized individual between June 19, 2020 and June 23, 2020 and contained the records of 3,905 patients. While there were similarities between both incidents, it was not possible to tell if the same individual was responsible.

In response to the incidents, LCJB has taken several steps to improve email security, including increasing password complexity, implementing 2-factor authentication for remote access, restricting access to systems to users within the United States, and enhancing its cybersecurity training program for staff members. Policies and procedures have also been developed and implemented that require personal information to be securely deleted regularly from the email system and the network.

1,700 Patients of Coast Dental Notified About Possible Theft of PHI

Tampa, Florida-based Coast Dental has started notifying 1,700 patients that records containing their protected health information are missing and have potentially been stolen.

A moving truck containing equipment and patient records was stolen from a parking lot in Atlanta, GA during the night of 6/7 August 2020. The theft was reported to the police department and the truck was recovered and impounded the following day. The truck was locked to secure the contents until the vehicle was released by the police department. An inventory of the contents of the truck was conducted between August 26-28, 2020 which revealed patient records were missing.

On October 13, 2020, notification letters were sent to all patients whose records may have been stolen and, out of an abundance of caution, patients whose Social Security number was potentially compromised have been offered complimentary credit monitoring services.

In response to the incident, Coast Dental has re-educated its workforce and has refined processes to better secure patient information.

The post Sonoma Valley Hospital Suffers Significant EHR Downtime Event appeared first on HIPAA Journal.