Blue Springs Family Care in Missouri has experienced a ransomware attack that has resulted in the encryption of sensitive data.

The attack was detected by the healthcare provider’s computer vendor on May 12, 2018.  An investigation was launched the same day by the computer vendor with assistance provided by a contracted third-party computer forensics firm.

In contrast to many ransomware attacks which involve a single ransomware variant being downloaded and blind file encryption, the attacker managed to gain access to Blue Springs Family Care systems and installed a variety of malicious software programs in addition to the ransomware.

Those malware programs would have given the attacker full access to all Blue Springs Family Care computer systems, including access to all patients protected health information. At the time of issuing notifications to patients, Blue Springs Family Care had not received any reports to suggest that any PHI was stolen and misused by the attacker. However, data access and data theft could not be ruled out.

The types of information potentially accessed included full names, home addresses, dates of birth, Social Security numbers, account numbers, driver’s license numbers, disability codes, and diagnoses.

The computer forensics firm was able to quarantine the entire system and prevent any further unauthorized data access. New software has now been installed which monitors for unauthorized access, and a new intrusion prevention system has also been implemented, which includes a new firewall.

Additionally, Blue Springs Family Care is changing over to a new electronic medical record system that encrypts all data at rest to ensure PHI cannot be accessed in the event that another data breach is experienced.

The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates 44,979 patients were affected by the breach.

The post Blue Springs Family Care Ransomware Attack Impacts 45,000 Patients appeared first on HIPAA Journal.

The phishing attacks on healthcare organizations continue… The past few days have seen two further healthcare organizations announce that email accounts were breached when employees responded to phishing emails.

Email Account Compromised at Boys Town National Research Hospital

Boys Town National Research Hospital (Boys Town), an Omaha, NE hospital specializing in pediatric deafness, visual and communication disorders, has announced that a recent phishing campaign has resulted in the email account of an employee being accessed by an unauthorized individual.

Boys Town first became aware of a security breach on May 23, 2018 when unusual email account activity was detected. Computer forensics experts were called in to investigate and a breach was confirmed to have occurred on May 23.

Boys Town painstakingly examined the account email-by-email to determine which patients potentially had their PHI exposed and the amount of PHI that was potentially compromised.

The breach was confirmed as being confined to a single email account, which contained sensitive information of current and former patients and employees.

The information in the email accounts varied by individual, but may have included names, dates of birth, Social Security numbers, driver’s license numbers, employer ID numbers, health insurance information, disability codes, birth certificate information, marriage certificate information, passport information, banking and other financial information, medical record numbers, usernames and passwords, Medicare/Medicaid ID numbers, diagnosis and treatment information, and billing/claims information.

No evidence of data exfiltration was uncovered, although it is possible that PHI was accessed and potentially obtained. Individuals impacted by the incident have been offered complimentary identity theft protection services for 12 months. A review of policies and procedures is being conducted and additional safeguards will be implemented to help prevent further phishing attacks.

NorthStar Anesthesia Discovers Multiple Email Accounts Accessed by Unauthorized Individuals

An email phishing campaign targeting Irving, TX-based NorthStar Anesthesia, a provider of outsourced anesthesia services, was conducted between April 3 and May 24, 2018. The phishing campaign was identified on May 23, 2018 with access to all compromised account blocked on May 24, 2018.

Third-party forensic investigators were called in to assist with the investigation and determine the extent of the attack and whether emails containing patients’ protected health information were accessed. The investigators determined that the compromised email accounts contained a range of protected health information which included names, health insurance application or claims information, birth dates, health insurance policy/subscriber numbers, taxpayer ID numbers, IRS identity protection numbers, medical histories, diagnosis and treatment information, medical record numbers, and for a limited number of individuals, Social Security numbers.

NorthStar Anesthesia is implementing additional safeguards to prevent further phishing attacks and affected individuals have been offered complimentary credit monitoring and identity restoration services for two years.

The post Boys Town National Research Hospital and NorthStar Anesthesia Discover PHI Compromised in Phishing Attacks appeared first on HIPAA Journal.

Golden Heart Administrative Professionals, a Fairbanks, AK-based billing company and business associate of several healthcare providers in Alaska, is notifying 44,600 individuals that some of their protected health information has potentially been accessed by unauthorized individuals as a result of a recent ransomware attack.

The ransomware was downloaded to a server containing the PHI of patients. According to a press release issued by the company, “All client patient information must assume to be compromised.”

Local and federal law enforcement agencies have been notified about the cyberattack and efforts are continuing to recover files.

The Golden Heart Administrative Professionals ransomware attack is the largest data breach reported by a healthcare organization in July, and the second major data breach to be reported by an Alaska-based healthcare organization in July.

In early July, the Alaska Department of Health and Social Services announced that it had suffered a data breach as a result of a malware infection. The Zeus/Zbot Trojan – an information stealer – had been downloaded which potentially allowed the attackers to gain access to the protected health information of ‘more than 500’ individuals.

Recent reports suggest ransomware attacks are declining, with many cybercriminal gangs switching operations to cryptocurrency mining; however, there does not appear to be any let up in ransomware attacks on healthcare organizations.

Last week, LabCorp, the national network of clinical testing laboratories, experienced a SamSam ransomware attack. The attack was detected within 50 minutes and systems were shut down to prevent widespread file encryption. The ransomware was downloaded following a brute force remote desktop protocol (RDP) attack. It is not currently known how many patients have been impacted by the attack, although some reports suggest millions of patients’ PHI may have been compromised.

On Monday, July 9, Cass Regional Medical Center in Harrisonville, MO, experienced a ransomware attack that resulted in its communications system and electronic medical record system being taken out of action. The medical center took the decision to redirect ambulances for stroke and trauma victims to alternate healthcare facilities. As with the LabCorp attack, the ransomware was downloaded to the server following a brute force RDP attack. The electronic medical record systems remained offline for 10 days as a result of the attack.

The post Golden Heart Administrative Professionals Ransomware Attack Impacts 44,600 Patients appeared first on HIPAA Journal.

Two more healthcare organizations have reported phishing attacks that have resulted in cybercriminals gaining access to the protected health information of patients, both of which saw the attackers gain access to multiple email accounts.

Sunspire Health, which runs a national network of addition treatment facilities, saw several email accounts compromised as a result of a phishing campaign targeting its employees. The attacks were discovered between April 10, 2018 and May 17, 2018.

Forensic investigators were called in to determine the nature and scope of the incidents. The investigation revealed the first email account was compromised on March 1, 2018, with further accounts compromised and accessed by unauthorized individuals up until May 4.

No patients have reported misuse of protected health information to Sunspire Health to date, and no evidence was found to suggest the email accounts had been misused, although it is possible that protected health information in the compromised email accounts was accessed and may have been downloaded by the attacker(s).

The types of information present in the emails included patients’ names, dates of birth, diagnoses, treatment information, health insurance details and Social Security numbers.

Patients impacted by the phishing attacks have now been notified and a substitute breach notice was uploaded to the Sunspire Health website on July 16. Patients affected by the breach have been offered credit monitoring and identity theft protection services at no charge.

The Department of Health and Human Services’ Office for Civil Rights has been notified, but the incident has yet to appear on its breach portal so it is unclear at this stage exactly how many patients have been affected.

Phishing Attack on UPMC Cole Sees Two Email Accounts Compromised

UPMC Cole in Coudersport, Pennsylvania has discovered two of its employees have been duped by phishing emails resulting in the disclosure of their login credentials. The email accounts were compromised on June 7 and June 14, 2018 and were discovered when staff members started receiving suspicious emails sent from the compromised email accounts.

Prompt action was taken to block access to the email accounts and an investigation was launched to determine whether any patient health information was accessed. While data access was not confirmed, it could not be ruled out with a high degree of certainty.

The email accounts only contained a limited amount of PHI and no financial information or Social Security numbers were compromised. The types of data exposed was limited to names, dates of birth, medical procedures performed, general treatment information, names of healthcare providers, and scheduling information.

790 patients were affected by the breach and notification letters have now been mailed.

The post Several Email Accounts Compromised in Sunspire Health and UPMC Cole Phishing Attacks appeared first on HIPAA Journal.