Resources for Human Development Reports Breach Affecting 46,673 Individuals

The Philadelphia, PA-based national human services nonprofit organization, Resources for Human Development (RHD), has recently confirmed that a hard drive containing the protected health information of 46,673 individuals has been stolen. The theft occurred on or around January 27, 2022, and was discovered by RHD on February 16, 2022.

The hard drive was used for its Point-to-Point program in Exton, PA, and contained information such as names, Social Security Numbers, drivers’ license numbers, financial account information, payment card information, dates of birth, prescription information, diagnosis information, treatment information, treatment providers, health insurance information, medical information, Medicare/Medicaid ID numbers, employer identification numbers, electronic signatures, usernames and passwords of clients and staff members.

RHD said it engaged outside forensics specialists to investigate the extent of the breach and ensure the security of its offices and computer servers. Training has also been provided to employees on best practices for protecting confidential information.

LockBit Ransomware Gang Claims Data Stolen from Tague Family Practice

The LockBit ransomware gang claims to have gained access to the systems of Tague Family Practice in St. Louis, MO, and exfiltrated sensitive data, some of which contained patients’ personal and protected health information.

A sample of the stolen data has been uploaded onto the gang’s data leak site. According to Databreaches.net, which was able to access a sample of the data, the data included claims and billing-related information. The data was uploaded to the leak site on March 17, 2022.

At this stage, Tague Family Practice has not confirmed a data breach has occurred and the incident has not appeared on the HHS’ Office for Civil Rights breach portal.

Email Breach Confirmed by Wellstar Health

Atlanta, GA-based Wellstar Health has recently confirmed that employee email accounts were accessed by unauthorized individuals who may have accessed or obtained patient information. Wellstar Health learned about the security breach on February 7, 2022, with the forensic investigation confirming that the breach was limited to two email accounts. No other systems were compromised.

The email accounts were discovered to have been compromised between December 6, 2021, and January 3, 2022. Upon discovery of the breach, the email accounts were immediately disabled and secured. A review of the accounts confirmed they contained protected health information such as employee names, medical record numbers, Internal account numbers, and laboratory information. No evidence was found to indicate any patient information was misused.

It is currently unclear how many patients have been affected.

Central Vermont Eye Care Reports Hacking Incident Affecting 30,000 Patients

A hacking incident has recently been reported by the Rutland, VT-based ophthalmology practice, Central Vermont Eye Care. The exact nature of the hacking incident is unclear at this stage; however, it has been confirmed that unauthorized individuals potentially gained access to the protected health information of up to 30,000 patients. Notification letters were sent to those individuals on April 6, 2022.

This post will be updated when further information becomes available.

The post Resources for Human Development, WellStar Health & Central Vermont Eye Care Announce Data Breaches appeared first on HIPAA Journal.

SuperCare Health, a Downey, CA-based post-acute, in-home respiratory care provider serving the Western United States, has recently started notifying 318,379 patients that some of their protected health information has been exposed and potentially accessed by unauthorized individuals in a cyberattack that occurred in July 2021.

In its March 25, 2022, breach notification letters, SuperCare Health explained that it identified unauthorized activity within its IT systems on July 27, 2021. Steps were immediately taken to secure its network and prevent further unauthorized access, and independent cybersecurity experts were engaged to investigate the nature and scope of the incident.

The investigation determined that unauthorized individuals had access to parts of its network from July 23, 2021, to July 27, 2021, and that it was possible that files on the network were accessed that contained patients’ protected health information. A comprehensive review of the contents of the files was conducted, which determined on February 4, 2022, that they contained sensitive patient data such as names, addresses, birth dates, hospital/medical group, patient account numbers, medical record numbers, health insurance information, testing/diagnostic/treatment information, other health-related information, and claims information. A subset of individuals also had their Social Security numbers and/or driver’s license numbers exposed.

SuperCare Health said the security breach prompted a review of its security safeguards and additional security measures have now been implemented to better protect the personal and protected health information of its patients.

SuperCare Health is offering affected individuals a complimentary membership to an identity theft protection service, which includes credit monitoring, dark web monitoring, and an identity theft reimbursement insurance policy.

Englewood Health Warns 3,900 Patients About PHI Exposure

Englewood Health, the operator of an acute care 289-bed teaching hospital in Englewood, NJ, has recently reported a security breach that involved the protected health information of 3,901 patients. On February 14, 2022, Englewood Health learned that the username and password of an employee had been compromised, which allowed an unauthorized individual to access patient names, dates of birth, and limited health information. Englewood Health said the unauthorized actor had access to patient data for less than 40 minutes before the intrusion was identified and blocked.

In response to the breach, Englewood Health has upgraded its physical, administrative, and technical network controls. Patients have now been notified by mail and while only a limited amount of data was exposed, complimentary credit monitoring services have been offered to affected patients.

The post Cyberattack on SuperCare Health Affects 318,000 Patients appeared first on HIPAA Journal.

Partnership Health Plan of California Recovering from Suspected Ransomware Attack

The Fairfield, CA-based nonprofit managed care health plan, Partnership Health Plan of California (PHC), has suffered a cyberattack that has taken its IT systems out of action for more than a week. PHC started notifying regional healthcare clinics on March 21, 2022, that its IT systems were disrupted, along with its website and phone lines and that efforts were underway to restore its systems. A timeline for when IT systems would likely be restored was not provided.

PHC did not state in its notifications what caused the outage, but it appears to have been a ransomware attack by the Hive ransomware operation. The Hive ransomware gang claimed responsibility for the cyberattack on its clear web and dark web sites and said 400 gigabytes of data was exfiltrated from PHC systems that included 850,000 unique records of name, SSNs, dates of birth, addresses, and other information. That claim has since been removed.

PHC has yet to confirm whether ransomware was used and the extent to which plan members’ data has been affected. PHC has around 618,000 health plan members in Northern California. The Hive ransomware gang is known to target the healthcare industry, having previously conducted ransomware attacks on Memorial Health System and Johnson Memorial Health last year.

Cancer and Hematology Centers of Western Michigan Suffers Ransomware Attack

Cancer and Hematology Centers of Western Michigan has recently announced it was the victim of a ransomware attack in December 2021 that affected part of its database. The healthcare provider said it partnered with a third-party IT and forensics firm to investigate the breach and restore its systems.

The breach investigation did not uncover evidence to suggest any patient data has been misused, but the parts of its systems that were accessed by the attackers contained parts of patients’ health records and employees’ Social Security numbers and bank account information.

Cancer and Hematology Centers of Western Michigan has started notifying affected individuals and complimentary credit monitoring services have been offered. Steps have been taken to strengthen data security procedures, including decommissioning several servers, providing additional training to the workforce, reviewing security policies and procedures, and contracting with a third-party company to provide ongoing security monitoring.

The breach has been reported to the HHS’ Office for Civil Rights as affecting 43,071 individuals.

LockBit Ransomware Gang Claims to Have Attacked Val Verde Regional Medical Center

The LockBit ransomware gang has recently published data on its leak site which it claims was stolen in a ransomware attack on Val Verde Regional Medical Center in Texas.

Lockbit has published around 400 MB of data on its website which includes files that include the data of more than 96,000 patients. The files contain information such asnames, patient ID numbers, account numbers, email addresses, addresses, phone numbers, dates of birth, employer addresses, marital status, guarantor names, referring physician names, health insurance information, notes, and other information.

Val Verde Regional Medical Center has not confirmed whether the claims of the Lockbit gang are genuine and the breach is not yet showing on the HHS’ Office for Civil Rights breach portal.

The post Ransomware Gangs Claim Health Plan and Healthcare Provider Attacked appeared first on HIPAA Journal.

Conti Ransomware Gang Claims Responsibility for Cyberattack on CSI Laboratories

Cytometry Specialists, Inc. doing business as CSI Laboratories in Alpharetta, GA, has recently announced it was the victim of a cyberattack that was discovered on February 12, 2022. An investigation was launched which confirmed that files containing limited patient data were exfiltrated from its systems, which mostly contained patient names and case numbers used for identifying patients, but for limited patients also included addresses, dates of birth, medical record numbers, and health insurance information.

CSI Laboratories said in its web notification that at this stage of the investigation there does not appear to have been any misuse of patient data. While CSI Laboratories did not disclose the nature of the cyberattack, the Conti ransomware gang has claimed responsibility and has published a sample of the exfiltrated data on its data leak site. CSI Laboratories said it has now brought its system back online and it is monitoring its network closely for unusual activity. There was no mention made about any ransom being paid.

The incident has yet to appear on the HHS’ Office for Civil Rights breach portal, so it is unclear how many individuals have been affected.

Email Account Breach Reported by Christie Clinic

Christie Business Holdings Company, P.C., doing business as Christie Clinic, has recently announced a security incident involving an employee’s email account. The company’s breach notice did not say when the breach was discovered, but the forensic investigation confirmed on January 27, 2022, that the email account was accessed by an unauthorized individual between July 14, 2021, and August 19, 2021.

Christie Clinic said the purpose of the attack appeared to be to intercept a business transaction between the clinic and a third-party vendor, rather than to obtain sensitive data from the email account, but it was not possible to determine to what extent emails in the account had been accessed. Christie Clinic said the investigation confirmed that the breach was limited to a single email account and no other systems or accounts were affected. The review of information in the account revealed on March 10, 2022, that the emails included protected health information such as names, addresses, Social Security numbers, medical information, and health insurance information. Notification letters were sent to affected individuals on March 24, 2022.

Christie Clinic said it already uses industry-leading network security solutions and performs regular and ongoing data security and privacy training and additional safeguards have been implemented.

Scripps Health Sends Additional Notification Letters About 2021 Ransomware Attack

On June 1, 2021, Scripps Health in San Diego notified the HHS’ Office for Civil Rights about a ransomware attack in which the protected health information of 147,267 patients was potentially compromised. Hackers had gained access to its network between April 26, 2021, and May 1, 2021, and potentially exfiltrated files containing patient data. The attack prompted class action lawsuits and cost the healthcare provider more than 113 million in losses.

Almost a year after its network was breached, NBC 7 was contacted by a patient who received a notification letter dated March 15, 2021, informing her that her protected health information was potentially compromised in the attack, including her name, address, date of birth, health insurance information, medical record number, patient account number, and clinical information such as diagnosis or treatment information had potentially been compromised. The patient had not previously been notified about the ransomware attack.

NBC 7 contacted Scripps Health, which confirmed that the manual document review recently concluded, and it was determined that additional patient data had potentially been compromised in the attack, but declined to say how many additional patients had been affected.

The post CSI Laboratories and Christie Clinic Report Data Breaches; Scripps Health Sends Additional Notification Letters appeared first on HIPAA Journal.

Oklahoma City Indian Clinic and Law Enforcement Health Benefits Inc. have confirmed they were recent victims of cyberattacks, both of which involved the use of ransomware.

Ransomware Attack Affects 85,282 Law Enforcement Health Benefits Members

Law Enforcement Health Benefits, Inc. (LEHB) has recently announced that it was the victim of a ransomware attack that was detected on September 14, 2021. External cybersecurity professionals were engaged to assist with the investigation and remediation efforts, and a manual review of files on the affected parts of the network was conducted. That process concluded on February 25, 2022, when it was confirmed that files containing the personal and protected health information of plan members had been exfiltrated from its network.

LEHB said the following types of information had been compromised: names, dates of birth, Social Security numbers, driver’s license numbers, financial account numbers, health insurance information, medical record numbers, patient account numbers, and diagnosis/treatment information.

While it was confirmed that files were exfiltrated from its systems, LEHB said it is unaware of any actual or attempted misuse of members’ information. Notification letters have been sent to individuals for whom a current address could be determined, and complimentary credit monitoring services have been offered to individuals whose Social Security numbers were potentially compromised. LEHB said it has taken steps to secure its network and improve internal procedures to allow the rapid identification and remediation of future threats.

The breach has been reported to the HHS’ Office for Civil Rights as affecting 85,282 individuals.

Oklahoma City Indian Clinic Investigating Cyberattack

Oklahoma City Indian Clinic (OKCIC), a 501(c)(3) non-profit organization that provides healthcare services to more than 20,000 patients from 200 Native American tribes in Oklahoma, recently announced on its website and social media accounts that ‘technological issues’ and network disruption are currently being experiencing which have prevented access to certain computer systems. The attack appears to have occurred on or around March 10, 2022 and has affected the automatic refill line and mail order services of its pharmacy.

The OKCIC IT team and third-party specialists are currently investigating the incident and are working to restore access to the affected systems. No mention was made of the nature of the incident, but it appears to be a ransomware attack. The Suncrypt ransomware gang has claimed responsibility for the cyberattack and has added Oklahoma City Indian Clinic to its data leak website. According to Databreaches.net, Suncrypt claims to have stolen more than 350 GB of data prior to encrypting files, including patients’ electronic medical records and financial documents.

Suncrypt has threatened to leak the data if Oklahoma City Indian Clinic does not negotiate and pay the ransom demand. Oklahoma City Indian Clinic said the investigation into the attack is ongoing and at this stage of the investigation, no evidence of data theft has been found.

This post will be updated when further information is made available.

The post Law Enforcement Health Benefits and Oklahoma City Indian Clinic Suffer Ransomware Attacks appeared first on HIPAA Journal.