UT Southwestern Medical Center (UTSW) has recently confirmed that the protected health information of 98,437 patients was stolen in a cyberattack on May 28, 2023. The Clop ransomware group exploited a zero-day vulnerability in Progress Software’s MOVEit file transfer solution, gained access to UTSW’s MOVEit server, and exfiltrated files that contained names, medical record numbers, dates of birth, medication names, medication dosages, prescribing provider names. A subset of the affected individuals also had their Social Security numbers stolen. UTSW was notified about the attack by Progress Software on May 30, 2023, and the exploited vulnerability was immediately patched.

The German cybersecurity firm KonBriefing has recently announced that its data shows at least 455 organizations were attacked in this campaign, and at least 23 million individuals were affected. The Clop group has recently started posting victim data on its clear web data leak site.

Family Vision of Anderson Suffers Ransomware Attack

Family Vision of Anderson in South Carolina was the victim of a May 2023 ransomware attack. A ransom note was detected on its computer system on May 28, 2023, indicating files had been encrypted. Computer systems were immediately taken offline to prevent further unauthorized access, and law enforcement was notified. The US Secret Service assisted with the investigation and determined ransomware was used to encrypt files on May 21.

The attackers may have obtained files containing the information of patients and their family members, including names, dates of birth, Social Security numbers, driver’s license numbers, telephone numbers, email addresses, gender, medical record numbers, health insurance information, allergies and other medical history information, appointment dates, scheduled optometrist names, optometry prescriptions, and optometry eye scans. Security has been enhanced, and employees have been provided with further training. The breach was reported to the HHS’ Office for Civil Rights as affecting up to 62,631 individuals. Notification letters have been sent and affected individuals have been offered complimentary identity theft protection services.

17,000 Individuals Affected by LifeWorks Wellness Center Hacking Incident

LifeWorks Wellness Center in Clearwater, FL, has recently reported a data breach to the Maine Attorney General that has affected 17,000 patients. Hackers gained access to its internal file system on or around May 20, 2023, and the forensic investigation confirmed that files containing patient data had been viewed, and may have been stolen. LifeWorks said the hackers did not gain access to its patient database, which includes medical and treatment records. The compromised servers included the information of current and former patients and employees such as names, Social Security numbers, credit card numbers, health identification codes, and medical conditions and diagnoses. LifeWorks said it has implemented additional security measures to prevent similar breaches in the future.

UC Davis Health Reports Breach of Employee Email Account

On May 24, 2023, UC Davis Health in Sacramento, CA, confirmed that the email account of an employee had been accessed by an unauthorized individual. The employee used their work email account to coordinate follow-up care for patients and the account included limited protected health information. The forensic investigation confirmed that only one email account had been compromised, and the breach was detected quickly by its IT security systems; however, it is possible that sensitive data was copied. Affected individuals have been offered complimentary credit monitoring services for 12 months and the employee concerned has received additional training on email security. The incident has yet to appear on the HHS’ Office for Civil Rights Breach portal, so it is currently unclear how many individuals have been affected.

Paramedic Billing Services Confirms Hackers Had Access to Patient Data

Elmhurst, IL-based Paramedic Billing Services has recently announced that it fell victim to a cyberattack in late May 2023. Suspicious activity was identified in its computer network and systems were immediately secured to prevent further unauthorized access. On June 23, 2023, Paramedic Billing Services determined that an unauthorized third party had access to systems containing protected health information and may have copied certain files from its systems. Those files included names, contact information, dates of birth, medical information, health insurance information, Social Security numbers, driver’s license/state identification numbers, financial account information, and payment card information.

The file review is ongoing, so the total number of affected individuals has yet to be established. The incident has been reported to the HHS’ Office for Civil Rights as involving at least 501 individuals. Notification letters will be sent to affected individuals when the review is completed. Paramedic Billing Services said its existing policies, processes, and procedures relating to data protection and security are being reviewed and will be enhanced.

Cardiac Monitoring Software Company Suffers Cyberattack

The Canadian cardiac monitoring software company, CardioComm Solutions Inc., has announced that it has suffered a cyberattack that has taken some of its IT systems out of operation. According to a statement released by the company, the attack has caused downtime to its services: Global Cardio 3, GEMS Flex 12, GEMS Home Flex (upload), and HeartCheck CardiBeat/GEMS Mobile ECG/RPM (record/upload). The disruption is expected to continue for several days, and potentially longer. Third-party cybersecurity experts have been engaged to investigate the attack and determine the extent to which sensitive data was involved. Customer data is not believed to have been involved, as CardioComm does not collect customer data, and its software runs on each customer’s server environment; however, employee data may have been compromised. Identity theft protection services will be offered to affected employees as a precaution.

The post 98,000 UT Southwestern Medical Center Patients Affected by MOVEit Cyberattack appeared first on HIPAA Journal.

Rite Aid has confirmed that the protected health information of up to 24,400 of its customers has been stolen in a cyberattack. The stolen files contained names, birth dates, addresses, prescription information, and limited insurance information. Social Security numbers and financial information were not exposed or stolen in the attack. Rite Aid said a vulnerability was exploited by the attackers to gain access to sensitive data. Rite Aid was notified about the vulnerability by a third-party vendor and a patch has now been applied to correct the vulnerability.

The vulnerability was identified on May 31, 2023, with the forensic investigation confirming data theft occurred on May 26, 2023. While Rite Aid did not disclose the name of the vendor, the timing of the attack and the nature of unauthorized access suggest this was an attack by the Clop threat group which conducted mass attacks that exploited a zero-day vulnerability in Progress Software’s MOVEIT Transfer file transfer solution.

Wake Family Eye Care Suffers Ransomware Attack

Wake Family Eye Care in Cary, NC, recently fell victim to a ransomware attack. The attack was detected on June 2, 2023, when files were discovered to have been encrypted. Systems were immediately isolated to prevent further unauthorized access and the incident was contained the same day. A third-party forensics firm was engaged to investigate and determine the extent of the breach and while no evidence of data theft was found, it was not possible to rule out the possibility of data theft.

The review of files on the affected part of the network revealed they contained names, addresses, dates of birth, partial or full Social Security Numbers, driver’s license/passport/other government-issued ID numbers, insurance numbers, optical images, chart numbers, and related eye records. Financial information was not compromised.

Notification letters have been sent to the 14,264 individuals potentially affected by the incident.

Catholic Charities of the Archdiocese of Newark Investigating Cyberattack

Catholic Charities of the Archdiocese of Newark has confirmed that unauthorized individuals gained access to some of its computer systems. The breach was detected on May 8, 2023, and third-party cybersecurity experts were engaged to investigate and determine the nature and scope of the breach. The investigation confirmed that hackers had access to systems where protected health information was stored between April 30, 2023, and May 8, 2023. Some of the files were acquired in the attack.

The stolen files included individuals’ names, dates of birth, driver’s license information, Social Security number, medical information, and health insurance information. The review of the files is ongoing to determine how many individuals have been affected and notification letters will be sent when that process has been completed. To meet the deadline for reporting data breaches, the HHS was notified that at least 501 individuals have likely been affected. The total will be updated when the investigation is completed.

Lancaster Orthopedic Group Notifies Patients About March Cyberattack

Lancaster Orthopedic Group in Manheim Township, PA, has discovered unauthorized access to its network. The breach was detected on March 29, 2023, with the review of the affected files confirming that names, addresses, dates of birth, Social Security numbers, medical treatment information, and insurance information was potentially compromised. The breach has been reported to the HHS’ Office for Civil Rights as affecting a minimum of 500 individuals, although up to 2,000 patients may have been affected.

The post 24,400 Rite Aid Customers Had Personal Informatiion Compromised in May Cyberattack appeared first on HIPAA Journal.

Tampa General Hospital has recently confirmed that hackers gained access to its network and stole files containing the protected health information of up to 1.2 million patients.  A security breach was detected on May 31, 2023, when suspicious activity was identified within its network. The affected systems were immediately taken offline to prevent further unauthorized access and a third-party digital forensics firm was engaged to investigate the incident and determine the nature and scope of the attack.

The investigation confirmed that unauthorized individuals had access to its network for three weeks between May 12, and May 30, 2023, during which time they exfiltrated files containing patient information. The information compromised in the incident varied from individual to individual and may have included names, phone numbers, addresses, dates of birth, Social Security numbers, medical record numbers, patient account numbers, dates of service, health insurance information, and limited treatment information. Tampa General Hospital confirmed that the hackers did not gain access to its electronic medical record system.

Tampa General Hospital said this was an attempted ransomware attack and while data theft occurred, its security systems prevented files from being encrypted. Additional technical security measures have now been implemented to harden its systems and prevent further data breaches and network monitoring has been enhanced to ensure that any future security breaches are detected rapidly.

Notification letters will be mailed to affected individuals when contact information has been verified.  Tampa General Hospital said affected individuals will be offered complimentary credit monitoring and identity theft protection services.

The post Tampa General Hospital Says Hackers Exfiltrated the Data of 1.2 Million Patients appeared first on HIPAA Journal.

Detroit, MI-based Henry Ford Health has recently notified 168,000 patients that an unauthorized individual gained access to employee email accounts that contained some of their protected health information. A spokesperson for Henry Ford Health said the unauthorized access occurred on March 30, 2023, after employees responded to phishing emails. The attack was discovered quickly and the accounts were secured; however, access to patient data was possible. A review of the email accounts confirmed on May 16, 2023, that they contained the following patient information: name, date of birth, age, gender, telephone number, medical record number/ internal tracking number, lab results, procedure type, diagnosis, and date(s) of service. Henry Ford Health is implementing additional security measures to protect against future email account breaches and additional training has been provided to employees.

IMX Medical Management Services Announces 2022 Malware Incident

The Malvern, PA-based medical consulting company, IMX Medical Management Services, has recently confirmed that malware was found on a laptop computer that potentially allowed unauthorized individuals to access the protected health information of 7,594 individuals. According to the notification letters, the malware was detected on September 1, 2022, and the forensic investigation revealed the malware had been present since as early as June 2022. Additional malware indicators were also found on its network in October 2022.

IMX said the malware has been removed and no further indicators of malware have been detected since October 2022. The delay in issuing notifications was due to the “extensive and complex analysis of the affected data.” IMX said the malware provided access to the bodies of email messages but attachments were not exfiltrated. The compromised information included names or other personal identifiers along with driver’s license numbers and other ID cards. Identity theft protection services have been offered to affected individuals.

Storage Unit Purchased at Auction Contained Dozens of Boxes of Patient Files

A storage unit was recently sold at auction that contained more than 200 boxes of patient files. The unit went up for sale when the unit rental payments stopped. The purchaser submitted a blind bid for the unit and discovered the boxes of patient files after purchasing the unit. The records related to patients of East Houston Medicine and Pediatric Center who received treatment between 2009 to 2019. The files included information such as names, Social Security numbers, driver’s license images, medical histories, and insurance information. The purchaser is currently trying to arrange for the files to be collected.

PHI Exposed in Charles George VA Medical Center Mismailing Incident

Charles George VA Medical Center in Asheville, NC, has confirmed that the personal information of 1,541 veterans has been exposed in an email mismailing incident. The data exposure was detected on May 12, 2023, and immediate steps were taken to delete the emails that had not been opened; however, the messages were opened by three veterans. The emails included an attachment that contained limited protected health information. Affected individuals have been offered complimentary credit monitoring and identity theft protection services.

The post 168,000 Patients Have PHI Exposed in Phishing Attack on Henry Ford Health appeared first on HIPAA Journal.

Pension Benefit Information, LLC, doing business as PBI Research Services (PBI), has recently confirmed that the protected health information of 371,359 individuals was obtained by the Clop ransomware hackers in an attack that exploited a zero-day vulnerability in the MOVEit Transfer file transfer solution on or around May 31, 2023.

PBI said the breach was discovered on June 2, 2023, and the patch to fix the flaw was applied the same day. The forensic investigation confirmed that one of PBI’s MOVEit Transfer servers was accessed by the Clop hackers on May 29 and May 30, 2023. The files stolen in the attack included names, partial mailing addresses, dates of birth, and Social Security numbers. PBI said it is unaware of any actual or attempted misuse of the stolen information; however, as a precaution, affected individuals have been offered two years of complimentary credit monitoring and identity theft protection services. Notifications started to be sent to the affected individuals on June 4, 2023.

LockBit Ransomware Group Announces Attack on Panorama Eyecare

The LockBit ransomware group has recently added Panorama Eyecare to its data leak site and claims to have exfiltrated 798 GB of data from the Colorado-based physician management organization, including data from its clients Eye Center of Northern Colorado, Denver Eye Surgeons, Cheyenne Eye Clinic & Surgery Center, and 2020 Vision Center. Panorama Eyecare has yet to publicly confirm the data breach and it is currently unclear to what extent patient data was involved.

8Base Ransomware Group Adds Kansas Medical Center to its Data Leak Site

Kansas Medical Center, a physician-owned hospital in Andover, KS, has recently been added to the data leak site of the 8Base ransomware group. The threat group claims the attack occurred on June 18, 203, and sensitive patient and employee data was stolen including names, addresses, registration information, and other information. Kansas Medical Center has not publicly announced the attack and it is unclear how many patients have been affected.

The post Pension Benefit Information Confirms PHI of 371,359 Individuals Stolen in MOVEit Transfer Hack appeared first on HIPAA Journal.

Phoenician Medical Center, Inc. (PMC) has recently reported a security incident that disrupted some of its IT systems. The incident was detected on March 31, 2023, although it is unclear from the breach notifications when hackers first gained access to its network. The forensic investigation confirmed that there had been unauthorized access to files containing the protected health information of patients, some of which may have been obtained by the hackers.

On April 25, 2023, PMC confirmed the affected information included names, contact information, demographic information, date of birth, state identification numbers, medical record numbers, diagnosis and treatment information, provider name(s), date(s) of service, prescription information, and/or health insurance information. Affected patients had received medical services at PMC or its affiliated companies, Phoenix Neurological & Pain Institute, and/or Laser Surgery Center between 2016 and 2023. The breach was reported to the HHS’ Office for Civil Rights as affecting up to 162,500 current and former patients. PMC said it will be enhancing its security protocols and technical safeguards to prevent similar incidents in the future.

Public Health Management Corporation Investigating May Cyberattack

The Philadelphia, PA-based nonprofit health institute, Public Health Management Corporation (PHMC), has recently announced that unauthorized individuals gained access to its systems. Suspicious activity was detected on May 8, 2023, and the forensic investigation confirmed that an unauthorized individual may have accessed and acquired sensitive patient information on May 8, 2023.

The exposed information included full names, addresses, Social Security numbers, birth dates, medical histories, mental and physical treatment information, diagnosis information, physician names, medical record numbers, and health insurance information. PHMC said it is currently reviewing the affected files and verifying contact information and will notify the affected individuals when that process is complete. In the meantime, the breach has been reported to the HHS’ Office for Civil Rights as affecting a minimum of 501 individuals. The total will be updated when the scale of the breach has been confirmed.

The post Phoenician Medical Center Cyberattack Affects Up to 162,500 Patients appeared first on HIPAA Journal.

Legal counsel for the Hollywood, CA-based plastic surgeon, Gary Motykie, M.D, recently notified patients about a cyberattack and data theft incident. According to the notification letters, Dr. Gary Motykie was recently contacted by a cyber threat actor who claimed to have accessed his IT systems and was in possession of sensitive patient information.

The notification was received on May 9, 2023, and a third-party incident response firm was engaged to investigate and determine the validity of the threat actor’s claims. A data breach was confirmed on or around June 6, 2023, with the review of the affected files confirming they contained information such as first and last name, address, driver’s license/identification card number, financial account information, payment card number and CVV code, Social Security Number, health insurance information, intake forms, which may include medical information and medical history, and images taken in connection with the services provided. The types of data varied from individual to individual and may have included only some of the above information.

The breach was recently reported to the Maine Attorney General as affecting a total of 3,461 individuals. Two years of complimentary credit monitoring and identity theft protection services have been offered to affected individuals and the practice has taken steps to improve data security. The incident has been reported to law enforcement, appropriate authorities, and the American Board of Plastic Surgery, which is also investigating the breach. The threat actor behind the attack was not named.

Attacks that involve the theft of naked images offer threat actors an easy way to increase pressure on the victim to make payment, as was the case with a ransomware attack on Lehigh Valley Health Network earlier this year by the ALPHV/BlackCat ransomware group. ALPHV also conducted a similar attack on another Californian plastic surgery clinic, Beverly Hills Plastic Surgery, according to recent media reports, where naked photographs were also published online when the ransom was not paid. Beverly Hills Plastic Surgery has yet to publicly confirm the data breach.

While not mentioned in the notification letters, Dr. Gary Motykie was allegedly issued with a ransom demand of $2.5 million. When payment was not received, the threat actor started publishing the stolen data, including topless images of patients along with personal information such as names, birthdates, email addresses, phone numbers, and financial information. Patients were contacted by the threat actor via email and links were shared to the Internet site where the stolen information and images were published.

Elaina Shaffy was one of the affected patients and had her photographs published online. She told NBC Los Angeles that she discovered her information had been leaked after being contacted by another patient who was in a similar position. She later discovered she had been emailed by the threat actor but had failed to see the message in her junk folder. She made contact with the threat actor and was informed that a third party had made a payment on her behalf and that her information and photographs had been removed. She has since filed a lawsuit against Dr. Gary Motykie over the theft of her information.

At least 70 individuals have had their photographs and personal information published online following the attack. Private images of Dr. Gary Motykie were also published online. Dr. Gary Motykie reportedly did not pay the ransom as there was no guarantee that the stolen data would be deleted.

The post Naked Patient Photos Published After Ransomware Attack on Plastic Surgery Clinic appeared first on HIPAA Journal.