The BlackCat ransomware group conducted a ransomware attack on the Fortune 500 firm Henry Schein and claimed to have stolen 35 TB of sensitive data. The healthcare giant was engaged in ongoing discussions with the group but negotiations had stalled. According to a spokesperson for the BlackCat group, “We have not received any indication of their willingness to prioritize the security of their clients, partners, and employees, let alone protect their own network.” Just as Henry Schein was about to finish restoring its systems, the BlackCat hackers struck again and re-encrypted its data.

Henry Schein confirmed in an October 15, 2023, announcement that it had been forced to take some of its systems offline to contain a cyberattack that had affected its manufacturing and distribution businesses. According to the announcement, the attack occurred the previous day. The company had been working around the clock to resolve the situation and bring its systems online, and as its investigation progressed it became clear that the ransomware group had gained access to sensitive customer and supplier information. That information included personal information, bank account information, and payment card numbers. Around two weeks after Henry Schein announced the attack, the BlackCat ransomware group claimed responsibility and added Henry Schein to its data leak site.

Henry Schein has now confirmed that the second attack resulted in applications such as its e-commerce platform being made unavailable; however, Henry Schein anticipated a quick recovery from the attack and only expected it to cause short-term disruption. Following the attack, the BlackCat group threatened to publish internal payroll data on its data leak site within a few hours if Henry Schein refused to negotiate, and claimed additional data would be released on a daily basis thereafter. Instead of posting data, BlackCat removed the listing. That could mean Henry Schein has started negotiating again or that a ransom payment has been made. Entries on the data leak sites of ransomware groups are typically only removed if a ransom has been paid.

The post BlackCat Ransomware Group Re-encrypts Henry Schein Data appeared first on HIPAA Journal.

Cyber actors often time their attacks to coincide with holiday periods when IT staffing levels are likely to be reduced to increase the probability of being able to access networks and exfiltrate data undetected, especially during Thanksgiving weekend. This year is no exception. A medical center in Idaho and an East Texas health system have announced that they are currently investigating potential cyberattacks that started on Thanksgiving Day. The nature of the attacks has not yet been disclosed and, at such an early stage in the investigations, it is unclear if patient data has been exposed or stolen.

UT Health East Texas, Texas

Tyler, TX-based UT Health East Texas, the operator of 10 hospitals and more than 90 healthcare clinics in East Texas, has confirmed that it experienced a network outage on Thursday, November 24, 2023. Steps were immediately taken to lock down its network to prevent any further unauthorized access. Without access to critical IT systems, ambulances were put on divert; however, care continues to be provided to patients with the health system operating under established downtime procedures. A statement was issued by a UT Health East Texas spokesperson saying network access is expected to be restored in around 24-36 hours, although it is currently unclear if that has happened.

Portneuf Medical Center, Idaho

Portneuf Medical Center in Pocatello, IA, has launched an investigation into a possible cyberattack and data breach that was detected on November 24, 2023. The attack resulted in a network outage, and the decision was taken to put the emergency room on divert status until access to its network was restored. The medical center is operating under established downtime procedures and says patient care has been unaffected.

Three Further Healthcare Providers Added to Hacking Group Data Leak Sites

Three healthcare providers have recently been added to the data leak sites of hacking groups.

Vanderbilt University Medical Center, Tennessee

Vanderbilt University Medical Center (VUMC), which operates seven hospitals and many healthcare facilities in and around Nashville, TN, has confirmed an investigation has been launched into a recent cyberattack. While the nature of the cyberattack has not yet been disclosed, VUMC has confirmed that a database was compromised in the attack, although the preliminary results of the investigation indicate neither patient nor employee data were stolen in the attack.

On November 24, 2023, VUMC was added to the Meow Leaks data leak site, along with 7 (non-healthcare) victims. The listing indicates the attack occurred on November 2, 2023, and the group claims to have 100% leaked the stolen data and has threatened to hack VUMC again if the ransom is not paid.

Crystal Lake Health Centers, Michigan

Crystal Lake Health Centers, the operator of 11 health centers in Michigan, has recently been added to the Hunters International data leak site. The listing includes a sample of 47.5 MB of data as evidence of the attack, and the group claims to have exfiltrated 120 GB of data in total including patient information such as contact details, SSNs, and insurance data. Hunters International is primarily a data theft and extortion group; however, has recently acquired the infrastructure and source code of the now-defunct Hive ransomware group.

Granger Medical Clinic, Utah

Granger Medical Clinic in Riverton, UT, was added to the data leak site of the NoEscape ransomware group on November 24, 2023.  It is not clear from the listing when the attack occurred but it appears that the clinic entered into negotiations before refusing to pay the ransom. The group claims to have infiltrated 38 GB of data and has published screenshots as proof of the attack. The NoEscape group claims to have successfully encrypted data on the network and exfiltrated employee data and patient data, including names, contact information, more than 2,000 passports, and tens of thousands of SSNs. The group demanded payment of $700,000 to prevent the release of the stone data.

The medical clinic has not yet announced the ransomware attack and data breach but has posted a notice on its website warning about emails that claim to be from Granger Medical Clinic about employment opportunities and said communications would only come from @GRANGERMEDICAL.COM, @SEND.APPLICANTEMAILS.COM, or @APPLICANTEMAIL.COM and the clinic would never ask for payment in relation to job opportunities. It is unclear if this scam is related to the ransomware attack.

The post Texas and Idaho Healthcare Providers Suffer Thanksgiving Day Cyberattacks appeared first on HIPAA Journal.

Mission Community Hospital, an acute care hospital serving the patients of the San Fernando Valley in California, has started notifying patients that some of their personal and protected health information was exposed in a May 2023 cyberattack.

Unauthorized access to its network was discovered on May 1, 2023, and the forensic investigation determined that an unauthorized third party accessed its network the same day, including files that contained patient data. The review of the files revealed they contained names, addresses, dates of birth, Social Security numbers, driver’s license numbers, financial account information, health insurance plan member IDs, claims data, and clinical information related to the care received at Mission Community Hospital.

Affected individuals have been offered a complimentary one-year membership to a credit monitoring and identity theft protection service. Mission Community Hospital said it has implemented additional safeguards and technical security measures to further protect and monitor its systems. The HHS’ Office for Civil Rights breach portal still shows the placeholder of 500 records in a report submitted on June 30, 2023. 500 is a commonly used placeholder to meet breach reporting requirements until the number of individuals affected is known.

The breach notification letter did not include details about the nature of the attack other than stating ” files containing some of your information may have been subject to unauthorized access,”; however, this appears to have been a ransomware attack. The RansomHouse ransomware group claimed responsibility for the attack and has added Mission Community Hospital to its dark web data leak site. In the listing, the group claims to have infiltrated “more than 2.5 TB” of data. The listing has a downloadable evidence pack, which consists of screenshots of its file system that appear to have been taken on April 16, 2023, around two weeks before unauthorized access was detected. The HIPAA Journal has confirmed that no data is currently showing on the listing, only the screenshots, which could indicate that the data has been sold per the group’s threat or the group is still holding out for payment. Listings are usually removed from data leak sites if a ransom is paid.

RansomHouse was behind a 2023 attack on Warren General Hospital, the listing for which is still on the group’s data leak site along with evidence packs, although there has been no data dump so far. Warren General Hospital recently reported the breach to OCR as affecting 168,921 individuals. A March 2023 attack on Albany ENT & Allergy Services is also listed, which includes a full data dump. According to the OCR breach portal, 224,486 patients of Albany ENT were affected by the attack.

The post Mission Community Hospital Alerts Patients About May 2023 Cyberattack appeared first on HIPAA Journal.

Data breaches have recently been announced by Longhorn Imaging Center in Texas, Woodfords Family Services in Maine, Prestige Care/Prestige Senior Living in Washington, WellLife Network Inc. in New York, and Frederiksted Health Care in the U.S. Virgin Islands.

Longhorn Imaging Center Data Breach

South Austin Health Imaging LLC, which does business as Longhorn Imaging Center in Austin, TX, has recently reported a hacking incident to the HHS’ Office for Civil Rights that has affected 100,643 patients. According to the breach notice submitted to the Texas Attorney General, the breached information included full names, addresses, dates of birth, medical information, and health insurance information. Notification letters are now being sent to the affected individuals.

There is currently no substitute breach notice on the Longhorn Imaging Center website and the imaging center has yet to confirm exactly what happened, including when the breach occurred and when it was detected; however, this appears to have been an attack by the SiegedSec threat group – the group behind the recent attack on the Idaho National Laboratory.

In early June, the group added Longhorn Imaging Center to its data leak site and claimed it had exfiltrated a database that included “physician full names, patient full names, patient treatment info, patient data of birth, patient gender, treatment date, institution name, and lost more.”

Woodfords Family Services Data Breach

Woodfords Family Services, a Westbrook, ME-based provider of services to people with special needs and their families, has recently reported a data breach to the HHS’ Office for Civil Rights that has affected 6,691 individuals.

According to its substitute breach notification, the forensic investigation confirmed that its network was accessed by an unauthorized third party on or around June 19, 2023, and files containing a limited amount of personal information may have been removed from its network. The document review confirmed the files contained full names in combination with one or more of the following: address, date of birth, phone number, email address, Social Security number, driver’s license number, government-issued identification number, medical record number, full face photo, unique identifier, certificate/license number, financial account information, credit/debit card information, passport number, medical treatment/diagnosis information, and/or health insurance policy information.

Affected individuals were notified on November 10, 2023, and complimentary credit monitoring services have been offered to individuals whose Social Security numbers were exposed.

Prestige Care Data Breach

Prestige Care/Prestige Senior Living in Washington has recently announced that it fell victim to a cyberattack that was detected on or around September 7, 2023, that resulted in its network being infected with malware that prevented access to certain files. The investigation confirmed the unauthorized actor accessed files on its systems the same day the breach was detected.

The investigation and file review are ongoing, and the total number of individuals affected has yet to be determined, although Prestige has said the information of current and former employees and residents was compromised in the attack. The impacted information varies from individual to individual and may include names, Social Security numbers, dates of birth, medical information, and health insurance information. Notification letters will be sent to the affected individuals when the review is completed. To meet regulatory breach reporting requirements, the incident has been reported to the HHS’ Office for Civil Rights as affecting at least 501 individuals. The total will be updated when the review is completed.

The HIPAA Journal previously reported that the ALPHV/BlackCat ransomware group claimed responsibility for the attack and had added Prestige to its data leak site and claimed to have stolen 260 GB of data. While the listing is still on the leak site, no data is currently downloadable.

WellLife Network Inc. Data Breach

WellLife Network Inc., a New York-based provider of behavioral health services, has recently issued an interim notification about a cyberattack that was detected on September 7, 2023. Third-party cybersecurity specialists were engaged to investigate unauthorized network activity and confirmed that an unauthorized third party accessed its network between August 26, 2023, and September 7, 2023, and viewed and/or copied files containing patient information.

The WellLife Network has started a manual and programmatic review of the affected files to determine the affected data and the number of individuals impacted. That review is ongoing, but it appears that the types of information involved include name, date of birth, demographic information, and/or other personal or health information. Individual notifications will be sent to the affected individuals when the review is completed. To meet regulatory breach reporting requirements, the incident has been reported to the HHS’ Office for Civil Rights as affecting at least 501 individuals. The total will be updated when the review is completed.

Frederiksted Health Care Data Breach

Frederiksted Health Care, Inc., a healthcare provider serving patients in the St. Croix community in the U.S. Virgin Islands, confirmed to local media in late October that it had suffered a cyberattack. Steps were immediately taken to secure its systems and an investigation was launched to determine the nature and scope of the incident. Local media reports indicate this was a ransomware attack. The healthcare provider has recently reported the incident to the HHS’ Office for Civil Rights as affecting 600 individuals.

The post Longhorn Imaging Center Cyberattack Affects More than 100,000 Patients appeared first on HIPAA Journal.

The Denver-based patient engagement company, WellTok, has recently confirmed that it was one of the victims of the Clop hacking group, which exploited a zero-day vulnerability (CVE-2023-34362) in Progress Software’s MOVEit Transfer file transfer tool in May 2023. Around 3.5 million individuals have been notified they have been affected by the Welltok data breach.

Welltok, which is owned by Virgin Pulse, works with health plan providers and manages communications with their subscribers through its platform. The company also operates a voluntary online wellness program for health plan subscribers that encourages healthy lifestyle changes. Welltok used the MOVEit Transfer tool for transferring large datasets across the Internet as part of its contracted services with health plans. According to Welltok, it was notified by Progress Software on May 31, 2023, about a vulnerability in the platform and applied the patch and mitigations as recommended by Progress Software. Its initial investigation suggested its MOVEit Transfer server had not been compromised. Then on July 26, 2023, it was alerted about an earlier breach of its MOVEit Transfer server, and on August 11, 2023, confirmed that the Clop group had exploited the vulnerability on May 30, 2023, the day before the patch was released. Data theft was confirmed on August 26, 2023.

A review of the affected files confirmed that they contained the data of health plan members such as names, dates of birth, addresses, and health information. Certain individuals also had their Social Security numbers, Medicare/Medicaid IDs, and health insurance information stolen. A substitute breach notification was uploaded to the Welltok website in October; however, it would only likely be found by individuals who visited the website, as the page had been set as no-index which meant it would not be indexed by search engines.

Welltok notified the Maine Attorney General about the data breach, which was reported as affecting 1,648,848 individuals. The notification was issued on behalf of the following group of health plans of Stanford Health Care:

• Stanford Health Care
• Lucile Packard Children’s Hospital Stanford
• Stanford Health Care Tri-Valley
• Stanford Medicine Partners
• Packard Children’s Health Alliance

The Welltok website notification states it is providing notifications on behalf of Sutter Health, Trane Technologies Company LLC, and group health plans sponsored by Trane Technologies Company LLC or Trane U.S. Inc. Those entities were not included in the Maine Attorney General notification. Sacramento, CA-based Sutter Health previously confirmed that it was affected by the Welltok data breach and said 845,451 individuals had been affected.

Arkansas-based St. Bernards Healthcare, Inc. separately reported the breach to the Maine Attorney General as affecting 89,556 individuals. Corewell Health, which serves patients in southeast Michigan, was also affected by the Welltok data breach and said approximately 1 million patients had been affected along with around 2,500 Priority Health members. Based on the reports so far, Welltok has notified around 3.5 million individuals that they were affected.

“Yet another stark example of supply chain vulnerabilities being exploited by cybercriminals. For far too long companies who develop software platforms have seen cybersecurity as an expense versus a functionality of doing business. Greater due diligence is necessitated by Virgin Pulse per runtime security and vulnerability management,” Tom Kellermann, SVP of Cyber Strategy at Contrast Security told the HIPAA Journal.

The latest tracking data from the cybersecurity firm Emsisoft shows the Clop hacking group mass exploited the vulnerability to attack at least 2,618 organizations globally, and the personal data of at least 77 million individuals was stolen. Emsisoft said the sectors most affected were education, healthcare, financial and professional services. While the vulnerability was exploited in late May, many organizations have only recently confirmed they were affected and those totals are certain to continue to rise. Many lawsuits have been filed in response to these data breaches, against the organizations affected as well as Progress Software. 58 lawsuits against Progress Software were consolidated into a single class action in Federal court in Massachusetts last month, as each made similar claims. The U.S. Securities and Exchange Commission (SEC) has also launched an investigation into Progress Software over the data breach.

“Once a vulnerability is made public, the hourglass is turned and IT teams have limited time before criminals take advantage of the vulnerability if they haven’t done so already,” Dror Liwer, co-founder of cybersecurity company Coro told the HIPAA Journal “To minimize the risk, removal of impacted software, or patching if available, must be immediate. Every sand grain that falls is an opportunity for the criminals, and an exposure to the organization.”

The post WellTok Data Breach: At Least 3.5 Million Individuals Notified appeared first on HIPAA Journal.

Daviess Community Hospital, an Ascension St. Vincent affiliated hospital in Washington, IN, has recently announced that it has launched an investigation after being notified by the U.S. Department of Homeland Security (DHS) about a possible security breach. According to the DHS, a security issue was identified during routine monitoring which may have been exploited by cyber actors.

Hospital CEO, Tracy Conway, said all internal systems have been shut down while the incident is investigated by a third-party digital forensics firm. Conway said no evidence has been found to date to indicate unauthorized access to its network or patient data, and no ransom demand has been received by the hospital. Disruption has been caused due to IT systems being taken offline, including phone lines to outpatient clinics and email, and the hospital has effectively been temporarily non-computerized. As a result, services have been limited until systems are restored and some appointments have been cancelled and will have to be rescheduled. The biggest impact is on radiology, as it is not possible to send images to be read. Conway said they are working around the clock to bring IT systems back online and are prioritizing the radiology and pharmacy interfaces.

Wyoming County Community Health System Reports March 2023 Cyberattack

Wyoming County Community Health System in Warsaw, NY, has recently notified 24,016 patients about a security incident that was detected on March 28, 2023. While not referred to as a ransomware attack, legal counsel for the health system said the attack disrupted its network. The forensic investigation revealed files containing patient information had been exposed and may have been viewed or acquired by unauthorized individuals in the attack.

A review of the files was completed on November 8, 2023, and confirmed they contained information such as names, Social Security numbers, driver’s license or state identification numbers, dates of birth, biometric data, medical information, health insurance information, and account numbers. The health system has implemented additional security measures to prevent similar breaches in the future and has offered affected individuals complimentary credit monitoring and identity theft protection services.

Southland Integrated Services Notifies Patients About October 2023 Cyberattack

Southland Integrated Services (SIS), a Californian community-based non-profit organization that operates a Federally Qualified Health Center, has recently notified certain individuals about the exposure of some of their protected health information. SIS explained in its November 10, 2023, breach notification letters that suspicious activity was detected within its computer systems on October 18, 2023.

The forensic investigation confirmed its systems had been accessed by an unauthorized third party between October 16 and October 18, 2023, and during that time, documents were viewed that contained patient data such as names, addresses, dates of birth, vaccination statuses, Social Security numbers, driver’s license numbers, and/or financial account information. Additional safeguards have been implemented to prevent similar breaches in the future and complimentary credit monitoring and identity theft protection services have been offered to the affected individuals. The incident has been reported to regulators but is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.

The post Daviess Community Hospital Investigating Potential Cyberattack appeared first on HIPAA Journal.

Medical Eye Services (CA), Prospect Medical Services (CA), McAlester Regional Health Center (OK), PeakMed (CO), Catholic Charities of Long Island (NY), & The Endocrine and Psychiatry Center (TX) have recently notified patients that their personal and health information has been exposed.

Medical Eye Services Says PHI of 370,000 Patients Stolen in MOVEit Transfer Hack

California-based Medical Eye Services, Inc. has recently confirmed that the protected health information of 346,828 individuals was stolen from the MOVEIt Transfer server used by the vision benefits management provider, MESVision, between May 28, 2023, and May 31, 2023. A zero-day vulnerability was exploited by the Clop cyber threat group, as part of a series of attacks on more than 2,300 organizations globally.

MESVision discovered it had been affected on August 23, 2023, and has since rebuilt its MOVEit server and implemented additional technical safeguards to prevent further breaches. The stolen data included names, dates of birth, Social Security numbers, subscriber/member IDs, policy numbers, group numbers, and claim numbers. Affected individuals have been offered complimentary credit monitoring and identity theft protection services through Kroll.

109,728 Connecticut Residents Impacted by Ransomware Attack on Prospect Medical Services

Between July 31, 2023, and August 1, 2023, the Rhysida ransomware group gained access to the network of Los Angeles, CA-based Prospect Medical Holdings. The breach was detected by Prospect Medical on August 1, 2023, and the breach was reported to the HHS’ Office for Civil Rights on September 29, 2023, as affecting 342,376 individuals, and individual notification letters were mailed the same day.

On November 13, 2023, additional notification letters were sent to 109,728 patients of the Eastern Connecticut Health Network (ECHN) Medical Group. The affected individuals had received healthcare services at Manchester Memorial Hospital, Rockville General Hospital, or Waterbury Hospital. Prospect Medical said the compromised information included names, addresses, dates of birth, diagnosis, lab results, medications, and other treatment information, and for some individuals, Social Security numbers and/or driver’s license numbers. Individuals who had their Social Security numbers or driver’s license numbers exposed have been offered 2 years of complimentary credit monitoring and identity theft protection services.

McAlester Regional Health Center Cyberattack Affects 38,000 Patients

McAlester Regional Health Center in Oklahoma has recently notified 37,731 patients about a security incident that was detected on May 8, 2023. Immediate action was taken to secure its network and a third-party cybersecurity firm was engaged to investigate to determine the nature and scope of the incident, which confirmed that files containing patient data had been exposed. A third-party vendor was engaged to review the affected files and the process was completed on October 23, 2023. Notification letters were mailed to the affected individuals on November 15, 2023. The exposed information included names, addresses, dates of birth, Social Security numbers, driver’s license numbers, and other government ID numbers.

McAlester Regional Health Center has tightened firewall restrictions, rewritten and strengthened its password policy, implemented password changes across the organization for every account, and increased restrictions on file sharing. Affected individuals have been provided with complimentary single-bureau credit monitoring services at no cost.

Compromised Credentials Used to Access PeakMed Network

PeakMed, a Colorado primary care provider, has started notifying 27,800 patients about a security breach that was detected on August 30, 2023.  An investigation of suspicious network activity confirmed that an unauthorized individual had obtained an employee’s credentials and used them to access its network between July 24, 2023, and August 30, 2023.

The documents that were accessed, and potentially acquired, were found to contain patient names along with one or more of the following: address, Social Security number, driver’s license number, date of birth, medical record number, financial account information, payment card information, electronic signature, billing/claims information, medical provider’s name, Medicare/Medicaid identification, medication information, treatment information, and health insurance information. PeakMed said all system passwords were reset when the breach was discovered, and 2-factor authentication has been implemented for all employee accounts.

Catholic Charities of Long Island Cyberattack Affects 13,000 Patients

Catholic Charities of the Diocese of Rockville Centre, doing business as Catholic Charities of Long Island in New York, has notified 13,000 patients that some of their personal information was exposed and potentially acquired by unauthorized individuals. Access appears to have been gained to its network via the Cisco AnyConnect VPN.

Unusual network activity was detected on September 3, 2023, and access to the network was immediately disconnected. A third-party cybersecurity firm was engaged to investigate the incident and determined that an unauthorized third party had accessed files that contained patient data, including names, addresses, dates of birth, Social Security numbers, driver’s license numbers, passports, and medical information.

The list of affected individuals was finalized on October 24, 2023, and notification letters were mailed on November 2, 2023. Catholic Charities has taken several steps to improve security, including installing threat hunting and endpoint detection and response solutions.

Endocrine and Psychiatry Center Discovers Theft of Historic Data

The Endocrine and Psychiatry Center in Texas has recently sent notifications to patients advising that some of their protected health information has been removed from its systems by an unauthorized individual. The theft occurred at some point prior to March 20, 2023, and involved data generated prior to 2017. A comprehensive review of the affected files was conducted and concluded on October 15, 2023, that the following information had potentially been compromised: full name, Social Security number, driver’s license number or other government identification number, date of birth, financial account information, credit or debit card information, treatment/diagnosis information, and/or health insurance information.

According to the notification sent to the Maine attorney General, 28,531 individuals were affected. The Endocrine and Psychiatry Center has offered those individuals a complimentary membership to the Equifax Credit Watch Gold service.

Bladen County, North Carolina Suffers Cyberattack

Bladen County in North Carolina is dealing with a cyberattack in which sensitive data was compromised. County officials said the attack impacted multiple server and internet-based systems, and the incident is being investigated by the North Carolina Joint Cybersecurity Task Force, which has helped to secure its servers. Rodney Hester, chairman of the Bladen County Board of Commissioners, confirmed that the county had emergency preparedness plans in place to deal with this kind of incident and confirmed that all emergency services remained operational throughout, although the county has been operating in a limited capacity since the attack.

The nature of the attack has not been disclosed, such as whether ransomware was involved. If ransomware was used, the ransom will not be paid as North Carolina prohibits ransom payments to ransomware gangs. It is currently unclear how many individuals have had their information stolen in the attack.

The post Healthcare Data Breach Round-Up: November 16, 2023 appeared first on HIPAA Journal.