Oswego County Opportunities (OCO) in New York has announced that a limited number of employee email accounts were recently accessed by an unknown actor. The security breach was identified when suspicious email activity was detected and the email accounts were immediately secured. Third-party cybersecurity experts were engaged to investigate the breach to determine the nature and scope of the attack, and what information, if any, had been accessed by the threat actor.

It was not possible to determine if any emails in the account had been viewed or obtained but the review of the affected email accounts confirmed they contained the following types of information: names, addresses, Social Security numbers, driver’s license numbers, certain health information, and a very limited amount of credit card numbers. The accounts also contained some employee information and information about vendors with connections to OCO.

The data breach has been reported to the HHS’ Office for Civil Rights as affecting 7,766 individuals. OCO said it has modified its email settings and controls to provide greater protection against cyberattacks of this nature.

Data Security Incident Reported by Washington University School of Medicine

Washington University School of Medicine in St Louis, MO, has recently announced that patient information has been exposed as a result of a recent data security incident. An unknown actor gained access to the email accounts of certain employees between March 4, 2022, and March 28, 2022.

A forensic investigation was conducted to determine if any emails or attachments were opened or obtained in the attack, although it was not possible to determine if patient data had been accessed or stolen. A review of all affected emails and attachments was conducted and confirmed they contained patient information such as names, dates of birth, addresses, medical records, patient account numbers, clinical information, and, for a limited number of patients, health insurance information and/or Social Security numbers.

In response to the breach, enhancements have been made to email security and employee training has been reinforced on how to identify and avoid suspicious emails. At present the data breach has not appeared on the HHS’ Office for Civil Right website so it is unclear how many patients have been affected; however, the School of Medicine said the breach did not affect all patients and research participants.

The post Email Incidents Reported by Washington University School of Medicine & Oswego County Opportunities appeared first on HIPAA Journal.

Social Action Community Health System (SAC Health) has recently notified 149,940 patients that documents containing their protected health information were stolen in a break-in at an off-site storage location where patient records were stored.

The break-in was discovered on March 4, 2022, with the subsequent investigation confirming on April 22, 2022, that six boxes of paper documents had been stolen from the facility, which included files relating to patients served by SAC Health in 1997 and between 2006 and 2020.

An analysis was conducted to determine which types of information were included in the files and concluded the documents may have contained information such as names, addresses, dates of birth, and diagnosis codes. Notification letters were sent to those individuals on May 3, 2022. SAC Health said it is unaware of any actual or attempted misuse of patient data as a result of the break-in; however, as a precaution against identity theft and fraud, affected individuals have been offered complimentary credit monitoring services. SAC Health said it is conducting a review of its policies and procedures concerning the storage of paper data.

Bryan County Ambulance Authority Ransomware Attack Affects 14,000 Patients

The Bryan County Ambulance Authority in Oklahoma has recently started notifying 14,273 patients about the exposure and potential theft of some of their protected health information. According to the notification letters, the attack was detected on November 24, 2021, when files on its systems were encrypted. Immediate action was taken to prevent further unauthorized access, and third-party cybersecurity consultants were engaged to assist with the forensic investigation.

The breach notice does not indicate what types of information were stolen in the attack but says affected individuals have been offered a complimentary membership to an identity theft protection service. According to the notice, the forensic investigation and document review took until April 7, 2022, hence the delay in issuing notifications to affected individuals.

Lifespan Services Suffers Ransomware Attack

Charlotte, NC-based Lifespan Services, a non-profit provider of services to individuals with disabilities, has recently confirmed it was the victim of a ransomware attack that affected data on its servers. The attack occurred on April 12, 2022, and prompt action was taken to secure its systems.

Lifespan said it was possible to restore all encrypted data within 24 hours of the attack, but the forensic investigation confirmed on May 3, 2022, that the individuals behind the attack had accessed files containing patients’ personal information, including names Social Security numbers, Medicaid numbers, driver’s license numbers, and bank routing numbers.

Lifespan said multiple layers of protection were in place, and additional security measures have now been implemented. A complimentary one-year membership to identity theft protection services has been offered to the 8,006 individuals affected.

Vice Society Claims Responsibility for Ransomware Attack on Atlanta Perinatal Associates

The Vice Society ransomware gang has claimed responsibility for a ransomware attack on Atlanta Perinatal Associates in Georgia. Atlanta Perinatal Associates specializes in treating mothers who have high-risk pregnancies, and coordinates care with other medical providers.

The healthcare provider has not yet confirmed it was a victim of a ransomware attack; however, Vice Society has uploaded data to its leak site that was allegedly stolen in the attack. The data includes names, dates of birth, ID numbers, expected due dates, referring physician names, sonographer names, ultrasound results, drug and alcohol use histories, other health information, and some records include credit card information and health insurance information. According to databreaches.net, which reviewed some of the files, they relate to records created between 2019 and April 2022.

Since the incident has yet to be reported to regulators, it is currently unclear how many patients have been affected.

The post SAC Health Theft Incident and Multiple Ransomware Attacks Reported appeared first on HIPAA Journal.

In March 2022, Partnership HealthPlan of California (PHC) announced that third-party forensic specialists had been engaged to help restore the functionality of its IT systems following a cyberattack. PHC has now confirmed in a breach notification to the Maine Attorney General that the protected health information of 854,913 current and former health plan members has potentially been stolen, making this one of the largest healthcare data breaches to be reported so far this year.

According to the notification, the cyberattack was detected on or around March 19, 2022. Steps were immediately taken to contain the breach and an investigation was launched to determine the nature and scope of the attack. PHC said the forensic investigation uncovered evidence that the unauthorized party behind the cyberattack had removed files from the PHC network on or around March 19.

The review of the affected files is ongoing, and while it has yet to be confirmed which specific types of protected health information were included in the affected files, notification letters are starting to be sent to affected individuals. PHC said the types of information potentially stolen may include names, birth dates, addresses, email addresses, Social Security numbers, driver’s license numbers, Tribal ID numbers, medical record numbers, health insurance information, diagnoses, treatment and prescription information other medical information, and member portal usernames and passwords.

While PHC did not state the nature of the cyberattack in its breach notification, the Hive ransomware gang has claimed responsibility for the attack and alleges around 400 GB of files were stolen, a sample of which was temporarily uploaded to the group’s data leak site. PHC said it is reviewing and enhancing its policies and procedures relating to data protection and security, and additional security measures and safeguards will be implemented to protect against this type of event in the future. PHC is covering the cost of access to credit monitoring services for affected individuals for two years. A class action lawsuit has already been filed on behalf of individuals affected by the breach.

The post Over 850,000 Individuals Affected by Partnership HealthPlan of California Cyberattack appeared first on HIPAA Journal.

Cleveland, OH-based Parker-Hannifin Corporation, a manufacturer of motion and control technologies, has recently announced that unauthorized individuals have gained access to some of its IT systems and may have acquired files containing the sensitive information of current and former employees, their dependents, and other individuals affiliated with the company.

Suspicious activity was detected within its IT environment on March 14, 2022. The forensic investigation confirmed its systems were accessed by unauthorized individuals between March 11, 2022, and March 14, 2022. A comprehensive review of the affected files confirmed they contained information such as names, birth dates, addresses, Social Security numbers, driver’s license numbers, passport numbers, financial account information such as bank account and routing numbers, and online account usernames and passwords. Current and former members of the Parker Group Health Plan, or a health plan sponsored by an entity acquired by Parker, may also have had their enrollment information compromised, which includes health insurance plan member ID number and dates of coverage.

The breach has been reported to the HHS’ Office for Civil Rights as affecting 119,513 group health plan members. Affected individuals have been notified and offered a complimentary 2-year membership to Experian’s IdentityWorks identity theft protection and resolution services.

Behavioral Health Partners of Metrowest Reports Data Theft Incident

Framingham, MA-based Behavioral Health Partners of Metrowest (BHPMW) has notified 11,288 individuals that some of their protected health information has been copied from its systems by an unauthorized individual. BHPMW learned of the data breach on October 1, 2022, with the forensic investigation confirming the unauthorized individual accessed its systems and removed data on September 14 and September 18, 2021.

The stolen data related to the Behavioral Health Community Partner Program which BHPMW operates under contract with MassHealth, in collaboration with the Advocates, Family Continuity, SMOC, Spectrum Health Systems, and Wayside Youth and Family Support provider agencies and included names, addresses, Social Security numbers, birth dates, client identification numbers, health insurance information, and medical diagnosis/treatment information. BHPMW is unaware of any attempted or actual misuse of the stolen information.

Notification letters were sent to affected individuals on May 11, 2022, and those individuals have been offered complimentary credit monitoring and identity protection services.

Vail Health Services Data Security Incident Affects 17,000 Patients

A data security incident at Vail Health in Colorado has resulted in the exposure and potential theft of the protected health information of 17,039 patients. Vail Health said it started experiencing disruption to its network systems and launched an investigation which revealed on April 5, 2022, that an unauthorized individual had gained access to its systems on February 11, 2022.

The compromised systems contained a small number of files that included information about individuals who received COVID-19 tests from Vail Health, such as names, birth dates, contact information, encounter numbers, and COVID-19 test results. No Financial information, health insurance information, or Social Security numbers were exposed or compromised.

The systems already had controls that restricted access to limited individuals. Additional security measures have now been implemented to further restrict access.

The post Parker-Hannifin Cyberattack Affects Almost 120,000 Health Plan Members appeared first on HIPAA Journal.

The Irving, TX-based nonprofit health system, Christus Health, which operates more than 600 healthcare facilities in Texas, Arkansas, Louisiana, and New Mexico, has announced it has recently identified suspicious activity in its computer systems and blocked an attempted cyberattack. The prompt action taken by the Christus IT team severely limited the scope of the attack and prevented the incident from impacting its patient care and clinical operations. Christus Health said it is working with third-party cybersecurity experts to investigate and determine the extent of the security breach.

A relatively new ransomware threat group called AvosLocker has claimed credit for the attack. AvosLocker operates under the ransomware-as-a-service (RaaS) model and was first identified in July 2021. The threat group engages in double extortion tactics and is known to exfiltrate data prior to file encryption, then threatens to auction the stolen data if the ransom is not paid.

The number of attacks conducted by Avosocker has been steadily growing, with data from Trend Micro indicating at least 30 attacks were conducted in January 2022, and 37 in February. The gang is known to exploit unpatched vulnerabilities to gain access to victim networks and is reported to use compromised RDP and VPN credentials. The location of the RaaS operation is not known, but it is probable that they are based in Russia or a Post-Soviet state since the group does not permit attacks in those countries. In March 2022, a joint cybersecurity advisory was issued by the FBI and the Department of the Treasury which provided Indicators of Compromise associated with AvosLocker.

Avoslocker has been targeting critical infrastructure entities in the United States, including healthcare organizations. One of the most recent victims was McKenzie Health System in Michigan, which was attacked by the gang in March 2022. The protected health information of 25,318 patients was potentially stolen in that attack, a sample of which was allegedly uploaded to the AvosLocker dark web leak site.

AvosLocker has uploaded a sample of data to its dark web leak site which was allegedly stolen in the attack on Christus Health. At this stage, the extent to which patient data has been affected has not been determined.

The post AvosLocker Claims Credit for Christus Health Ransomware Attack appeared first on HIPAA Journal.