Recent Breaches Underscore High Healthcare Security Risk

Healthcare institutions in California and Arizona are sending breach notification letters after attackers compromised thousands of patients data.

Cyberattacks continue to pummel healthcare organizations already stretched thin by lack of resources and the ongoing COVID-19 pandemic, as evidenced by two recently disclosed attacks targeting providers in California and Arizona.
Starting Aug. 24, 2021, California-based LifeLong Medical Care began informing individuals that their data was affected in a ransomware attack against Netgain, a third-party vendor that provides services to healthcare providers.
LifeLong reported
to the Department of Health and Human Services that 115,448 people were affected in the attack.
Netgain first detected anomalous network activity on Nov. 24, 2020, LifeLong reported in a letter disclosing the breach to affected customers. On Feb. 25, 2021, Netgains investigation revealed certain files were accessed and/or acquired without authorization. LifeLong conducted a review of the contents of the stolen files to determine whether they contained any sensitive data.
On Aug. 9, LifeLong found some identifiable personal and health information was accessed from Netgains network in relation to the attack. This data included full names and one or more of the following: Social Security numbers, dates of birth, patient cardholder numbers, and/or treatment and diagnosis information,
the letter states
. Officials are not aware of reports of identity fraud or improper use of the affected data directly related to the attack.
LifeLong advises those affected to take steps to protect their data with actions such as placing a fraud alert or security freeze on their credit files, receiving free credit reports, enrolling in free credit monitoring if their SSN was affected, and paying close attention when reviewing financial statements, credit reports, and explanation of benefits statements for suspicious activity.
In a separate attack, Arizona-based Desert Wells Family Medicine has begun notifying patients whose data may have been involved in a recent ransomware and data loss incident that took place on May 21, 2021, and affected many of its IT systems.
When it learned of suspicious activity on its network, Desert Wells hired security experts and an incident response team to assess and remediate the damage. The healthcare provider also alerted federal law enforcement and began an investigation with a third-party IT forensics firm to determine the extent of information accessed and stolen by the attackers.
Their investigation revealed no evidence that sensitive data was taken; however, the attacker who accessed the network corrupted the data. As a result, the patient electronic health records that Desert Wells possessed before May 21 cannot be recovered despite our exhaustive efforts to try to recover our patients sensitive information, officials
wrote in their letter
.
The data in affected patient records may have included patients names in combination with their address, date of birth, Social Security number, drivers license number, patient account number, billing account number, health insurance plan member ID, medical record number, dates of service, provider names, and medical and clinical treatment information, they report.
To date, the firms investigating the attack have not found evidence indicating any of this information has been misused.
Desert Wells says it will continue trying to rebuild patients electronic health records in a new and enhanced electronic medical record system, a process that includes compiling patient data from other sources, such as medical specialists, previous medical providers, hospitals, pharmacies, imaging centers, and labs, among others. The provider is offering complimentary credit monitoring and identity theft protection, and patients are advised to review statements from healthcare providers and insurers to watch for medical services they did not receive.
News of the attacks follows research that finds midsize healthcare organizations
face higher costs
after cyberattacks compared with larger organizations. The average cost of a cyberattack-related shutdown exceeds $440,000 for smaller organizations and $130,000 for larger ones. Researchers say while attacks against healthcare have increased, many victims – especially midsize hospitals – have not adapted to the change.

Last News
▸ Beware EMV may not fully protect against skilled thieves. ◂ Discovered: 23/12/2024 Category: security	▸ Hack Your Hotel Room ◂ Discovered: 23/12/2024 Category: security	▸ Website hacks happened during World Cup final. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Recent Breaches Underscore High Healthcare Security Risk