Ransomware Attacks Reported by Foursquare Healthcare and Hi-School Pharmacy

Posted by Steve Alder

Foursquare Healthcare Ltd, a Rockwall, TX-based operator of short-term rehabilitation, skilled nursing, and long-term nursing care facilities has recently confirmed it experienced a ransomware attack in September. The ransomware attack was detected on September 27, 2023, and the forensic investigation confirmed the attackers accessed its network between September 27, 2023, and September 29, 2023, and acquired certain files that contained employee and patient information. The information in the files varied from individual to individual and included names along with one or more of the following: address, billing information, Social Security number, banking information, and clinical information regarding care received at its clinics.

The attack did not cause any material disruption to Foursquare care or services and no evidence has been found to indicate that any of the stolen data has been misused for identity theft or fraud. Foursquare said it has received assurances that all of the stolen data has been deleted. That usually, but not always, means the ransom was paid. Foursquare said it believes the incident has been contained and it will continue to monitor its systems for unauthorized activity.

The breach has recently been reported to the HHS’ Office for Civil Rights as involving the protected health information of 10,890 patients. Foursquare has offered the affected individuals two years of complimentary credit monitoring and identity theft protection services and while assurances were provided that the stolen data has been deleted, Foursquare encourages the affected patients and employees to be vigilant against identity theft and fraud.

Hi-School Pharmacy Suffers Ransomware Attack

The Vancouver, WA-based drug store chain, Hi-School Pharmacy, has recently notified the Maine Attorney General about a data breach that has affected 17,676 individuals. On November 3, 2023, Hi-School Pharmacy experienced a cyberattack that caused network disruption. The forensic investigation confirmed on November 21, 2023, that the attackers had access to parts of the network that contained protected health information including names and Social Security numbers. Notification letters were sent to the affected individuals on November 5, 2023. Credit monitoring and identity theft protection services have been offered to the affected individuals.

The post Ransomware Attacks Reported by Foursquare Healthcare and Hi-School Pharmacy appeared first on HIPAA Journal.

9 Prime Healthcare Hospitals Affected by MOVEit Data Breach

Posted by Steve Alder

Ontario, CA-based Prime Healthcare has been affected by a data breach at its revenue cycle management vendor, CBIZ KA. The vendor used Progress Software’s MOVEit Transfer solution, a zero-day vulnerability in which was exploited by the Clop hacking group in late May 2023. Prime Healthcare received a copy of the stolen files from CBIZ KA on September 20, 2023, and has confirmed that they contained names in combination with one or more of the following: date of birth, address, medical record number, Social Security Number, admission date, and discharge date.

Prime Healthcare operates 45 hospitals, although only 9 were affected: Saint Clare’s Hospital, Saint Michael’s Medical Center, and St. Mary’s General Hospital in New Jersey, Roxborough Memorial Hospital, Lower Bucks Hospital, and Suburban Community Hospital in Pennsylvania, Garden City Hospital and Lake Huron Medical Center in Michigan, and Landmark Medical Center in Rhode Island. Individuals whose Social Security numbers were involved have been offered complimentary credit monitoring and identity protection services.

PHI Compromised in Cyberattack on Sierra County, CA

Sierra County in California experienced a “sophisticated cyberattack” on or around February 21, 2023. Sierra County detected the breach on March 5, 2023, secured its systems to prevent further unauthorized access, and engaged third-party cybersecurity experts to investigate the breach. The investigation revealed the attackers had access to parts of the network that contained information such as names, addresses, dates of birth, email addresses, phone numbers, Social Security numbers, driver’s license or government ID numbers, medical/prescription or health insurance related information, drug or alcohol screening results, credit or debit card numbers, biometric data, or financial account/routing numbers. No evidence has been found that indicates actual or attempted misuse of the impacted data. The Department of Public Health and Department of Behavioral Health confirmed that the protected health information of 2,463 individuals was exposed and potentially stolen in the attack.

Email Account Breach Reported by Advarra, Inc.

Advarra, Inc., a Columbia, MD-based provider of integrated research compliance solutions, has discovered unauthorized access to an employee email account. The email account breach was detected on October 26, 2023, and the account was immediately disabled. The forensic investigation confirmed that the breach was limited to a single account, with the unauthorized access commencing on October 25, 2023. The attacker copied information from the account that included names and Social Security numbers. The breach was recently reported to the Maine Attorney General as affecting 1,782 individuals. No evidence of misuse of the stolen data has been identified; however, as a precaution, affected individuals have been offered complimentary credit monitoring services for 24 months and those individuals are being encouraged to take advantage of those services.

The post 9 Prime Healthcare Hospitals Affected by MOVEit Data Breach appeared first on HIPAA Journal.

23andMe Updates Terms of Service to Prevent Class Action Lawsuits

Posted by Steve Alder

23andMe has updated its terms and conditions in an attempt to prevent its customers from joining class action lawsuits following a massive data breach that affected 6.9 million of its customers. In October 2023, a collection of the data was uploaded to a dark web forum that was allegedly stolen from 23andMe. The dataset contained information on around 1 million Ashkenazi Jews and 100,000 individuals of Chinese descent, then the hacker advertised a further dataset a couple of weeks later that contained the information of a further 4.1 million individuals.

23andMe investigated and determined that approximately 14,000 accounts were compromised in a credential stuffing attack, which was made possible due to password reuse by those customers. The compromised accounts were used to access the ancestry data of 6.9 million users through the DNA Relatives feature (5.5 million users) and the Family Tree feature (1.4 million users). Per its financial reports, 23andMe has around 14 million customers, which means almost half were affected by the data breach. 23andMe maintains that there was no breach of its systems.

Several lawsuits have already been filed against 23andMe over the data breach. One such lawsuit was filed in the Supreme Court in British Columbia with the lead plaintiff claiming that his personal data was stolen and listed for sale on the dark web. The lawsuit alleges 23andMe engaged in “willful, knowing or reckless conduct” by failing to implement and maintain proper data retention and data protection practices. The lawsuit seeks monetary damages, including the price that affected customers paid for 23andMe’s services. Thousands of Canadians have already added their names to the class action lawsuit. Another lawsuit was filed in California that alleges negligence, invasion of privacy, unjust enrichment, and breach of implied contract. The plaintiffs claim that 23andMe implemented inadequate safeguards to protect sensitive user data, did not do enough to prevent intrusions, and did not provide adequate training to staff.

In response, 23andMe has updated its terms of service to force its customers into a binding arbitration, which requires all disputes to be resolved out of court. The updated terms prohibit customers from joining class action lawsuits against the company. The terms of service apply to all new customers, but also to all existing customers unless they opt out. 23andMe emailed its customers on November 30, 2023, about the update to its terms of service and gave them 30 days to opt out. If they do not opt out they will be assumed to have agreed to the new terms of service. Customers hoping to join a class action over the recent data breach must opt out of the new terms of service by December 30, 2023.

The change, which is now prominently displayed in its terms of service in full caps, states, “TO THE FULLEST EXTENT ALLOWED BY APPLICABLE LAW, YOU AND WE AGREE THAT EACH PARTY MAY BRING DISPUTES AGAINST THE OTHER PARTY ONLY IN AN INDIVIDUAL CAPACITY, AND NOT AS A CLASS ACTION OR COLLECTIVE ACTION OR CLASS ARBITRATION.”

The new terms of service mean cases must be arbitrated by a neutral third-party arbitrator, who would decide on the validity of each case. Any decision made by the arbitrator is legally binding and must be accepted by both parties and the arbitrator’s decision cannot be appealed. Since arbitration requires cases to be dealt with on an individual basis, it takes away the power of a group. The new terms and conditions are likely to reduce the number of individuals eligible to participate in class action lawsuits and will thus limit the costs for 23andMe should those lawsuits prove successful.

Arbitration is generally a faster process that could see any payments or refunds issued much more rapidly than a class action. 23andMe explained that the new terms of service will encourage prompt resolution; however, they also include a new 60-day initial dispute resolution period, during which time both parties agree to a delay to arbitration. While the new terms of service will help to prevent class action lawsuits, they do permit mass arbitration. If 25 or more customers issue similar demands for arbitration based on the same or similar subject matter or if they share common issues of law or fact, they can be dealt with through mass arbitration. In such cases, mass arbitration would be handled by National Arbitration and Mediation (NAM), a nationally recognized provider of alternative dispute resolution services.

The post 23andMe Updates Terms of Service to Prevent Class Action Lawsuits appeared first on HIPAA Journal.