A MongoDB database containing the personal records of around 5 million individuals has been left exposed on the internet.

The database contained personal information and health data and belonged to MedicareSupplement.com, a website run by TZ Insurance Solutions which helps individuals find a Medigap insurance plan. Individuals looking for coverage can visit the website to find out more about suitable health plans and can obtain quotes by filling out an online form and entering their personal information.

Researchers from Compariteh and security researcher Bob Diachenko discovered the database on May 13, 2019. The marketing database contains information such as name, address, telephone number, email address, IP address, date of birth, gender, and information relating to health, life, auto, and supplemental insurance.  Around 239,000 records included the area of insurance interest.

It is unclear for how long the database was exposed, but it was indexed by the search engine BinaryEdge on May 10, 2019.

The researchers reported the breach to MedicareSupplement.com but no response was received, although the database has now been secured and is no longer accessible.

As a result of the lack of authentication controls it would have been possible for a hacker to delete or alter data or install malware on the system.

Summa Health Patients Notified of Data Breach

An unauthorized individual has gained access to the email accounts of several employees of the Akron, OH hospital system Summa Health and potentially viewed or copied patient information.

The email accounts were discovered to have been compromised on May 1, 2019. The Summa Health investigation confirmed that two employee email accounts had been compromised in August 2018, with a further two accounts compromised on March 11 and March 29 as a result of employees responding to phishing emails.

Summa Health hired a leading computer forensics firm to investigate the breach. The company confirmed that the accounts had been accessed and PHI had potentially been viewed. No evidence was uncovered to suggest any patient information was viewed or stolen, but the possibility could not be ruled out.

For the majority of patients, the types of information that were exposed were limited to names, dates of birth, patient account numbers, medical record numbers, and some clinical and treatment information. A small subset of patients also had their Social Security number or driver’s license number exposed.

Summa Health will be implementing additional security measures to prevent further email security breaches and staff will be provided with additional training on privacy and security.

Summa Health has not confirmed how many patients were affected other than saying the breach impacted more than 500 individuals.

The post 5 Million Records Exposed Due to Unsecured MongoDB Marketing Database appeared first on HIPAA Journal.

Patients of Quantum Vision Centers and Eye Surgery Center in Illinois are being notified that some of their protected health information may have been compromised in an April 2019 ransomware attack.

An unauthorized individual gained access to certain Quantum systems and deployed ransomware on April 18, 2019. The ransomware encrypted files, some of which contained information such as names, dates of birth, addresses, health insurance information, and Social Security numbers.

A third-party computer forensics firm has been hired to help determine the nature and scope of the attack. The investigation is ongoing, but it is believed that the malware was not used to steal any patient information. The sole purpose of the attack appears to have been to extort money from the business.

Encrypted files are now being recovered and backup measures have been implemented to ensure services can continue to be provided to patients, albeit with some disruption.

It is currently unclear exactly how many patients have been affected. Affected individuals have been offered one year of credit monitoring services.

Marin Community Clinics Recovers from Ransomware Attack

Marin Community Clinics in California has experienced a ransomware attack that caused considerable disruption to its IT systems last week.

The attack occurred between 9pm and 10pm on Wednesday, June 19 and resulted in widespread file encryption. A ransom demand was issued and, after consulting with its network operator, Marin Community Clinics paid an undisclosed percentage of the ransom demand.

Computer systems were taken out of action as a result of the attack. Even with the keys to unlock the encrypted files, recovery has taken several days. All computer systems are expected to be brought back online by Saturday 22, June.

Medical services continued to be provided to patients while computer systems were down and the hospital was operating in emergency mode. Patient information was recorded on paper and will be transferred when systems are brought back online. The data recovery process is progressing and major data loss is not anticipated.

Marin Community Clinics’ CEO Mitesh Popat told the Marin Independent Journal that no patient data was compromised and major data loss is not expected; however, there may be minor data loss for certain patients as a result of the data recovery process.

It is currently unclear how the ransomware was introduced and for how long the hackers had access to its systems prior to the deployment of ransomware.

The post Ransomware Attacks Reported by California and Illinois Clinics appeared first on HIPAA Journal.

Broome County in New York has started notifying 7,048 individuals that some of their protected health information (PHI) was compromised in a phishing attack on county employees.

Broome County officials learned about the attack on January 2, 2019 when it was discovered that an employee’s direct deposit account information had been changed. An investigation was immediately launched which revealed ‘numerous’ Broome County email accounts had been compromised as a result of responses to phishing emails. Further, an unauthorized individual had also gained access to employees’ PeopleSoft accounts.

A computer forensics expert was hired to assist with the investigation and determine how and when access to the accounts was first gained. That investigation revealed the first accounts were compromised on November 20, 2018 and further accounts were compromised up to January 2, 2019.

Employee direct deposit information has been checked and all emails and email attachments in the compromised accounts have been analyzed.

Broome County says multiple county departments were affected, including the Department of Health. The Willow Point Nursing Home and Rehabilitation & Nursing Center were also affected.

The types of information in the emails varied from individual to individual, but may have included names, contact information, Social Security numbers, bank account numbers, other financial information, dates of birth, medical record numbers, patient identification numbers, health insurance information, claims information, and medical and clinical information such as diagnoses and treatment information.

Broome County will implement additional safeguards to protect against any future attempted cyberattacks, including multi-factor authentication, and additional training will be provided to staff.

Community Health Link Phishing Attack Impacts 4,598 Patients

UMass Memorial Community Healthlink, a provider of behavioral health, addiction, and homeless services throughout central Massachusetts, has discovered the email accounts of two employees have been accessed by an unauthorized individual.

The breach was detected on April 18, 2019 and the accounts were secured. The breach investigation revealed the accounts were first accessed the same day and information in the compromised email accounts was only available for a limited time period.

No evidence was found to suggest emails had been viewed or copied; however, the following information may have been subjected to unauthorized access: Names, dates of birth, client identification numbers, diagnosis and treatment information, health insurance information, and in limited instances, Social Security numbers.

In response to the breach, passwords were reset, rules were strengthened to prevent email accounts from being accessed from external domains, automatic alerts have been increased, and defenses have been strengthened against email impersonation attacks. Further training has also been provided to employees.

The post Phishing Attacks Reported by Broome County, NY and UMassMemorial Community Healthlink appeared first on HIPAA Journal.

A provider of software for assisted living communities has experienced a ransomware attack that has affected more than 60 facilities that use the software.

Tenx Systems, doing business as ResiDex Software, said the attack occurred on April 9, 2019 and affected its server infrastructure.

Rapid action was taken to move the servers to a new hosting provider and files were seamlessly recovered from backups the same day as the attack. No ransom was paid.

A forensic investigation was launched to determine whether any files had been accessed or other malicious actions had been performed by the attackers. The investigation revealed its servers were first compromised on April 2, 2019, 7 days prior to the deployment of ransomware.

While extortion through file encryption may have been the main aim of the attack, it is possible that the attackers gained access to names, Social Security numbers, and medical records contained in the ResiDex system.

It was not possible to establish which, if any, records were subjected to unauthorized access due to the complexity of the attack and the steps taken by the attackers to conceal their activities.

Notifications are now being sent to all affected individuals, which are spread across Massachusetts, Minnesota, Missouri and Tennessee.

The number of individuals affected has not been publicly disclosed and the incident has yet to appear on the HHS’ Office for Civil Rights Breach Portal.

Prescription Information of 78,000 U.S. Patients Exposed Online

Security researchers at vpnMentor have discovered a freely accessible database of patient prescription information that contains records relating to more than 78,000 U.S. patients who use the prescription medication Vascepa.

Vascepa is a drug used to lower triglycerides for individuals on low-cholesterol and low fat diets. The MongoDB database had been left unprotected allowing the following information to be viewed without authentication: Names, addresses, telephone numbers, email addresses, pharmacy information, prescribing doctor, NPI number, NABP E-profile number, and other personally identifiable data.

The records appeared to have come from a company called PSKW, which provides patient and provider messaging, co-pay, and assistance programs for healthcare organizations via a service named ConnectiveRX.

vpnMentor has reported the breach PSKW, although it is currently unclear to whom the database belongs.

The post Ransomware Attack Affects More than 60 Assisted Living Facilities appeared first on HIPAA Journal.

Two healthcare providers in Maryland have been affected by a potential breach at their business associate, Meditab Software Inc.

Meditab provides EMR and practice management software to healthcare providers and its systems contain patient information. In March 2019, Meditab discovered some protected health information (PHI) had been left unprotected.

Meditab had created a portal to view statistics for its Fax Cloud services. Statistics were maintained on all faxes, but no images were stored directly on the fax server. When faxes were transmitted, a link to the fax image on a separate and secure server was temporarily available until the fax was confirmed as having been received. When receipt was confirmed, the link is no longer available.

Usernames and passwords were required to gain access to the portal; however, in January, a Meditab programmer deactivated authentication without authorization. While authentication was disabled, a limited number of faxes containing medical information were discoverable between January 9 and March 14, 2019.

The exposed information may have included names, addresses, phone numbers, dates of birth, and medical records and treatment notes, which may include diagnoses and treatment information.

The firm recently informed Capitol Cardiology Associates (CCA) and Southern Maryland Medical Group (SMMG) that the PHI of some of their patients had been exposed.

Meditab said at no point could its analytics portal be searched or crawled by search engines, so discovering the portal would not have been easy. However, if the portal was located, an unauthorized individual could have opened the fax messages individually and had the option of downloading or printing those faxes. Meditab believes the risk of harm to patients is low.

According to the breach reports submitted to the HHS’ Office for Civil Rights, 1,980 CCA patients and 1,400 SMMG patients have been affected.

It is currently unclear whether any other healthcare providers have been affected by the breach.

The post Potential Breach at Meditab Software Impacts 2 Maryland Healthcare Providers appeared first on HIPAA Journal.