Lorien Health Services based in Ellicott City, MD, which manages 9 assisted living facilities throughout Maryland had encountered a ransomware attack on June 6, 2020.
Third-party cybersecurity specialists assisted with the investigation to ascertain whether the attackers accessed patient information. On June 10, 2020, the investigators confirmed that the hackers had accessed files with the names of residents, dates of birth, addresses, diagnoses, treatment details, and some workers’ Social Security numbers. Some of that data was stolen by the attackers.
The operators of Netwalker ransomware conducted the attack. Because Lorien Health Services did not pay the attackers’ ransom, a part of the stolen data was published on the internet.
Lorien Health reported the incident to the FBI who investigated the ransomware attack. The company also reported to the Department of Health and Human Services indicating that the protected health information (PHI) of 47,754 people was compromised. The affected individuals received offers of complimentary credit monitoring and identity theft protection services. The breach notification letters were sent out to all impacted people on June 16, 2020, just 10 days following the attack.
Security Breach at Accu Copy of Greenville Impacts 21,800 Patients
Accu Copy of Greenville, Incorporated in NC provides businesses with printing and billing statement mailing services. Unauthorized individuals acquired access to one of its servers and might have accessed records that contain the protected health information of patients of a healthcare provider serving eastern North Carolina called Physicians East.
Accu Copy discovered the breach on April 10, 2020 and immediately worked on preventing any more unauthorized PHI access. The breach investigation results showed that the unauthorized individual began accessing the server on April 1, 2020. Accu Copy confirmed on May 15, 2020 that patient PHI might have been accessed. The review of the records on the server was finished on June 26, 2020.
The server was determined to have the billing statements for 21,800 patients. The statements linked to patient visits to a Physicians East office and contained names, addresses, diagnosis data, treatment details, the cost of treatment, and provider name.
After the breach, all passwords were altered, and support was sought from a cybersecurity firm to help enhance security.
National Cardiovascular Partners Reports Email Security Breach
National Cardiovascular Partners, a department of Fresenius Medical Care North America, is notifying patients about a potential breach of their personal data and PHI.
On May 19, 2020, National Cardiovascular Partners found out that an unauthorized person got access to an employee’s email account. Immediately, the healthcare provider secured the account and investigated the incident. According to the investigation results, the breach of the email account occurred on April 27, 2020. On June 18, 2020, the completed analysis of the breached account confirmed that it contained patients’ PHI.
National Cardiovascular Partners is convinced the attacker’s intention was to defraud the company, and not to acquire patient information. There is no evidence identified that indicate the attacker accessed or acquired patient data.
National Cardiovascular Partners took action to enhance email security and provided further training on email security to its employees. The provider also offered the affected patients a one-year free Experian’s IdentityWorks identity theft protection service membership.
