Why Healthcare Security Matters

guest · Mar 30, 2020

American HomePatient Data Breach Class Action Settlement
March 27, 2020
https://topclassactions.com/lawsuit...epatient-data-breach-class-action-settlement/

American HomePatient has agreed to pay $1 million to resolve claims that they failed to protect patient data in a burglary incident.

The settlement benefits current or former patients and customers of American HomePatient Inc. and Lincare Holdings Inc. whose personal identifying information was stored on the unencrypted hard drives stolen from American HomePatient’s location on Jan. 6, 2017. Class Members must have suffered injury or harm from this breach.
American HomePatient did not admit to any wrongdoing but, in 2019, agreed to pay $1 million to resolve the claims against them.
Click to expand...

hawki · Apr 1, 2020

"Hackers ‘Without Conscience’ Demand Ransom From Health Providers

Criminals taking advantage of pandemic to launch cyber-attacks

Encrypting records could keep doctors from vital patient data...

'We have now seen a number of instances where clinical labs involved in testing, or major hospitals, have suffered ransomware attacks, where all their IT systems have been knocked down'...”

https://www.bloomberg.com/news/arti...medium=social&utm_campaign=socialflow-organic

Minimalist · Apr 1, 2020

Microsoft is Alerting Hospitals Vulnerable to Ransomware Attacks

Microsoft has started to send targeted notifications to dozens of hospitals about vulnerable public-facing VPN devices and gateways located on their network.
Click to expand...

https://www.bleepingcomputer.com/ne...g-hospitals-vulnerable-to-ransomware-attacks/

guest · Apr 1, 2020

mood said: ↑

Roundup of Recent Healthcare Data Breaches March 20, 2020
Texas Network of Walk-in Clinics Attacked with Maze Ransomware
AffordaCare Urgent Care Clinic, a network of walk-in clinics in Texas, has been attacked by the Maze ransomware gang.
Click to expand...

Affordacare patients notified of security breach
March 31, 2020
https://eu.reporternews.com/story/n...urity-breach-personal-data-stolen/5099523002/

Affordacare Urgent Care Clinics, which operates two locations in Abilene, notified patients by letter of a security breach that may have exposed their data earlier in the year.

According to a Tuesday news release, Affordacare discovered on Feb. 4 that its servers had suffered a ransomware attack on or around Feb. 1. After investigating, they determined that hackers had accessed the servers and some confidential information may have been removed, the release said.
The servers had information that included "patient name, address, telephone number, date of birth, age, date of visit, [...]
Click to expand...

Affordacare - Frequently Asked Questions

ronjor · Apr 2, 2020

COVID-19 Crisis Triggers More HIPAA Policy Changes

Marianne Kolbasuk McGee (HealthInfoSec) • April 2, 2020
Business Associates Cleared to Make 'Good Faith' Disclosures of PHI
Click to expand...

guest · Apr 5, 2020

Data Breach: A summary of healthcare security incidents in March 2020. Are you a victim of Medical Identity Theft?
April 3, 2020
https://hotforsecurity.bitdefender....a-victim-of-medical-identity-theft-22819.html

A quick overview of data breaches from the healthcare industry in March 2020 reveals 26 security incidents added to the Health Insurance Portability and Accountability Act (HIPAA) Breach Reporting Tool.
Out of the 26 data breaches, 13 are due to hacking or other IT incidents, affecting 338,334 individuals. Other noteworthy data breach causes are theft, loss and unauthorized access or disclosure of information, impacting 44,592 individuals.
How can criminals capitalize on stolen PHI?
Medical records are highly desired on the dark web, and can sell for as much as $1,000, depending on how much information they provide on victims. Cyber thieves can use stolen healthcare records in a variety of illegal schemes.
What are the signs of medical identity theft?
The risk of falling victim to medical identity theft might not have crossed your mind until now. We know that criminals are in search of fast ways to profit from stolen data. However, it’s crucial to remember that your medical records include more than your lab work and test results.
Nobody wants to be denied medical assistance or have legal problems due to fraudulent schemes. Here’s a list of the most common signs of medical identity theft: [...]
Click to expand...

guest · Apr 5, 2020

Criminal investigation launched into breach of confidential patient records at Rand Memorial Hospital
April 4, 2020
http://www.thebahamasweekly.com/pub...cords_at_Rand_Memorial_Hospital_printer.shtml

The Public Hospitals Authority (PHA) has launched a criminal investigation into the leak and dissemination on social media of a purported confidential document pertaining to clients of the Grand Bahama Health Services. The PHA has been assured that the matter which is now in the hands of the authorities will result in a swift and serious outcome for those who are engaged in the leak and circulation of this document.

The public is advised that patient health records are confidential and cannot be released without the consent of the patient. Any breach of this privacy is punishable under the Data Protection (Privacy of Personal Information) Act, and all persons found to have obtained unauthorized health information and forwarded this information, will be brought before the Court.
Grand Bahama Health Services continues to maintain the strictest commitment to the privacy of its patients and the protection of their health information.
Click to expand...

Dermot7 · Apr 6, 2020

By Dan Swinhoe
CSO | Apr 6, 2020 3:00 am PDT

Gourav Mukherjee is a managing partner at vCISO firm Immersion Security. Since January he has been acting CISO at a private equity-backed healthcare company with hundreds of locations across the US. In addition to managing security for the organization, Mukherjee now must deal with business continuity issues. “They have internal security staff but don't have the expertise and leadership above a director level and are without a CISO at the moment,” he says.

Mukherjee contracted COVID-19 during a meeting in Florida. He has been in isolation and though he described the experience as akin to having flu and bronchitis at the same time, he is through the worst of it. “I think I was better equipped because I work in the security space and provide virtual services. For me to move some of the in-person meetings that I have in the last week to online wasn't a big deal.”
Click to expand...

How one healthcare CISO is navigating the COVID-19 crisis | CSO Online

Minimalist · Apr 6, 2020

Interpol: Ransomware attacks on hospitals are increasing

The INTERPOL (International Criminal Police Organisation) warns that cybercriminals are increasingly attempting to lockout hospitals out of critical systems by attempting to deploy ransomware on their networks despite the currently ongoing COVID-19 outbreak.
Click to expand...

https://www.bleepingcomputer.com/ne...nsomware-attacks-on-hospitals-are-increasing/

guest · Apr 7, 2020

Australian health sector does not have 'cybersecurity problem', says insurer
Despite consistently high number of notifiable data breaches
April 7, 2020
https://www.itnews.com.au/news/aust...ave-cybersecurity-problem-says-insurer-546096

Australia’s healthcare sector does not have a “broader cybersecurity problem” despite consistently reporting higher numbers of data breaches than other industries, according to medical indemnity insurer MIGA.

In a parliamentary submission published on Monday afternoon [pdf], MIGA defended the security record of the “private healthcare sector”, arguing that notifiable data breach (NDB) numbers needed to be understood in “context”.
Health service providers have “consistently reported the most data breaches compared to other industry sectors since the start of the NDB scheme”, according to the Office of the Australian Information Commissioner (OAIC).

But, according to MIGA, “comparatively higher levels of notifiable data breaches are understandable" and "are not suggestive of a broader cybersecurity problem in healthcare."
Click to expand...

FanJ · Apr 7, 2020

Minimalist said: ↑

Interpol: Ransomware attacks on hospitals are increasing

https://www.bleepingcomputer.com/ne...nsomware-attacks-on-hospitals-are-increasing/
Click to expand...

INTERPOL : Cybercriminals targeting critical healthcare institutions with ransomware - 4 April 2020
https://www.interpol.int/News-and-E...tical-healthcare-institutions-with-ransomware

SINGAPORE – Hospitals and other institutions on the front lines of the fight against the coronavirus facing unprecedented physical dangers are now also facing another threat from cybercriminals.

INTERPOL has issued a warning to organizations at the forefront of the global response to the COVID-19 outbreak that have also become targets of ransomware attacks, which are designed to lock them out of their critical systems in an attempt to extort payments.

INTERPOL’s Cybercrime Threat Response team at its Cyber Fusion Centre has detected a significant increase in the number of attempted ransomware attacks against key organizations and infrastructure engaged in the virus response. Cybercriminals are using ransomware to hold hospitals and medical services digitally hostage; preventing them from accessing vital files and systems until a ransom is paid.

To support global efforts against this critical danger, INTERPOL has issued a Purple Notice alerting police in all its 194 member countries to the heightened ransomware threat.
Click to expand...

“Locking hospitals out of their critical systems will not only delay the swift medical response required during these unprecedented times, it could directly lead to deaths. INTERPOL continues to stand by its member countries and provide any assistance necessary to ensure our vital healthcare systems remain untouched and the criminals targeting them held accountable,” added the INTERPOL Chief.
Click to expand...

guest · Apr 7, 2020

Minimalist said: ↑

Cyber gangsters hit UK medical firm poised for work on Coronavirus with Maze ransomware attack

https://www.computerweekly.com/news...-lorganisation-poised-for-work-on-Coronavirus
Click to expand...

Drug testing firm sends data breach alerts after ransomware attack
April 7, 2020
https://www.bleepingcomputer.com/ne...s-data-breach-alerts-after-ransomware-attack/

Hammersmith Medicines Research LTD (HMR), a research company on standby to perform live trials of Coronavirus vaccines, has started emailing data breach notifications after having their data stolen and published in a ransomware attack.
This attack occurred on March 14th, 2020, when the Maze Ransomware operators stole data hosted on HMR's network and then began to encrypt their computers.
Click to expand...

guest · Apr 8, 2020

Stockdale Radiology Is Circulating Notices About a Data Breach
April 7, 2020
https://www.technadu.com/stockdale-radiology-circulating-notices-data-breach/97917/

The Stockdale Radiology medical diagnostics and analysis center is circulating notices of a data breach to its patients. As it seems, the company has fallen victim to a ransomware attack on January 17, 2020, with the network intruders managing to access locally stored patient data.
The firm clarifies that, while the data was accessible, there is no indication they have been exposed, misused, or exfiltrated.

The investigation, which was conducted with the help of FBI agents, revealed that the data types involved in this incident include full patient names, home addresses, and sensitive personal information such as healthcare logs, doctor’s notes, and their social security numbers (SSNs).
Stockdale Radiology says they immediately shut down the compromised system and contracted a cyber-security expert to help them figure out exactly what had happened.
Click to expand...

guest · Apr 10, 2020

Healthcare security: LA respiratory hospital hit by supplier data breach
April 10, 2020
https://portswigger.net/daily-swig/...piratory-hospital-hit-by-supplier-data-breach

A Los Angeles hospital that specializes in treating respiratory diseases says its patients’ personal data may have been exposed during a breach at one of its suppliers.

Current and former patients of Barlow Respiratory Hospital have been potentially impacted by the compromise of an employee email account at Healthcare Resource Group (HRG) in November 2019, according to a press release issued on April 7.
In a security alert Barlow Respiratory Hospital said that HRG, which provides medical billing services, handled patients’ information in managing Barlow’s referral process.

HRG’s notification letter, and the hospital’s security alert, have advised potentially impacted patients to regularly review account statements and monitor credit reports in case of unauthorized activity.
The hospital said “HRG is currently evaluating and updating, as appropriate, its privacy policies and procedures” and has “enhanced security awareness training among its workforce”.
Click to expand...

guest · Apr 10, 2020

Delaware urology practice hit with ransomware in January
...impacting 131,825 patients (HHS Breach Portal)

NOTICE OF POTENTIAL DATA BREACH - Brandywine Urology Consultants

On January 27, 2020, the Practice became aware that its network had become the victim of a ransomware attack, which appears to have begun on January 25, 2020. The Practice’s information technology firm (the “IT Firm”) took immediate steps to isolate and mitigate the intrusion to its network. The attack was neutralized, and a complete scan of the central server was run to assure no malicious software remained.

To date, the investigation has not yet completed, but the Practice expects that it will be completed soon, and hopes to inform you that your information has not been compromised. It is possible, however, that your personal information was accessed or disclosed in the ransomware event. Rest assured that the Practice has taken steps to mitigate the intrusion and increase its defenses against future intrusion.
Click to expand...

guest · Apr 13, 2020

Compromised email account leads to Saint Francis Ministries data breach
April 13, 2020
https://www.scmagazine.com/home/sec...eads-to-saint-francis-ministries-data-breach/

An unauthorized party gained entry into an an employee’s email account at Saint Francis Ministries, accessing sensitive personal identifying information, as well as financial and protected health data.

In an online notification and corresponding press release, the Salina, Kan.-based non-profit organization said the actor accessed the account between Dec. 13 and 20 of 2019. Saint Francis first noticed the anomalous activity on Dec. 19, confirmed the illegal access on Feb. 12 and determined on March 24 that data belonging to multiple individuals was exposed.
Affected information includes social security numbers, birth dates, driver’s licenses and state IDs, bank and financial account numbers, payment card numbers, treatment and diagnosis information, prescription information, [...]

“While we have security measures in place to protect information in our care, we are also taking steps to implement additional safeguards and review policies and procedures in order to protect the security of information on our systems,” Saint Francis said in its online statement.
Click to expand...

guest · Apr 13, 2020

Doctors Community Medical Center Provides Notice of a Phishing Event
April 13, 2020
https://www.dchweb.org/doctors-community-medical-center-provides-notice-phishing-event

In January 2020, DCMC noticed suspicious activity within its payroll system. Upon investigation, hospital officials determined that a small number of employees had fallen victim to a phishing attack. By obtaining employees' credentials in the phishing attack, the unauthorized third party was able to access employees' payroll information and their email accounts.

As part of the investigation, officials determined that some of the email accounts contained data sheets with patient demographic information [...] prescription information, provider name, medical record number/patient ID, Medicare/Medicaid number, health insurance information, treatment cost information, and access credentials.

“We take this incident and the security of personal information seriously,” Lehr continued. “As part of our ongoing commitment to the privacy of personal information in our care, we are reviewing our existing policies and procedures and implementing additional safeguards to further secure the information in our systems. [...]”
Click to expand...

guest · Apr 14, 2020

PHI of 16,600 Patients Potentially Compromised in Ransomware Attack on Andrews Braces
April 14, 2020
https://www.hipaajournal.com/phi-of...mised-in-ransomware-attack-on-andrews-braces/

The Sparks, NV orthodontics practice, Andrews Braces, has experienced a ransomware attack that resulted in the encryption of patient data. The attack was discovered on February 14, 2020, with the subsequent investigation determining the ransomware was downloaded the previous day.

The practice hired a third-party forensic investigator to assess the scope and extent of the attack and determine whether patient information had been accessed or exfiltrated prior to encryption.
[...] regularly backed up patient data and stored its backups securely, so it was possible to restore the encrypted files without paying the ransom.
The types of data which could potentially have been accessed by the attacker included names, addresses, dates of birth, Social Security numbers, email addresses, and health information.

Andrews Braces has now implemented additional security solutions and has taken other steps to harden security to prevent further attacks in the future.
Click to expand...

EVERSANA Sends Notification Letters to Patients About 2019 Data Breach
EVERSANA, an independent provider of global services to the life sciences industry, has discovered an unauthorized individual gained access to the email accounts of some of its employees in 2019.

EVERSANA was notified about unusual activity in its employees’ accounts and determined that the accounts had been accessed by an unauthorized individual through a legacy technology environment. The investigation revealed the accounts were compromised between April 1 and July 3, 2019.
The accounts contained information from a limited number of patient services programs.
Click to expand...

guest · Apr 15, 2020

Hospital computer system not fully restored after attack
April 15, 2020
https://apnews.com/91df3c5a57e8fd77225db2322d17bd94

A northwestern Pennsylvania hospital’s computer system has yet to be restored fully almost three weeks after it was hit by a computer virus, officials said.

The March 26 malware (malicious software) attack took down a number of functions at Meadville Medical Center from email to electronic medical records, the Meadville Tribune reported.
Five days after the attack, the hospital said a third-party forensic firm had determined that it was safe to bring the system’s electronic medical records back online. Other systems remain down, officials said.

The hospital said Tuesday that it had identified and removed malware on its system and has been “working diligently” to restore complete access.
Click to expand...

guest · Apr 17, 2020

FBI says state hackers have broken into US coronavirus research: report
April 17, 2020
https://www.fox5dc.com/news/fbi-says-state-hackers-have-broken-into-us-coronavirus-research-report

Foreign government hackers have broken into companies conducting research into COVID-19 treatment and the U.S. healthcare sector, an FBI official reportedly said.

Tonya Ugoretz, the FBI Deputy Assistant Director, told participants in an online panel discussion on Thursday that the bureau has seen state-backed hackers looking at a series of healthcare and research institutions.
She didn't specify what countries backed the hackers or what organizations were targeted.

“We certainly have seen reconnaissance activity, and some intrusions, into some of those institutions, especially those that have publicly identified themselves as working on COVID-related research,” Ugoretz said, according to Reuters.
She said that hackers routinely have their sights set on the biopharmaceutical industry but their activity is usually increased during a crisis like the coronavirus pandemic.
Click to expand...

“Medical research organizations and those who work for them should be vigilant against threat actors seeking to steal intellectual property or other sensitive data related to America’s response to the COVID19 pandemic,” he added, according to Reuters.
Click to expand...

Minimalist · Apr 17, 2020

Czech cyber officials warn of serious threat to health care sector

Cybersecurity authorities in the Czech Republic on Thursday warned the public about the threat of an “extensive campaign of cyberattacks” on IT systems and health care facilities that could be carried out in the coming days.
Click to expand...

https://www.cyberscoop.com/czech-republic-cyberthreat-health-care-coronavirus/

guest · Apr 17, 2020

mood said: ↑

Roundup of Recent Healthcare Data Breaches March 20, 2020
[...]
Tandem Diabetes Care Patients Notified About Phishing Attack
Tandem Diabetes Care, Inc. in San Diego, CA has been targeted by cybercriminals who gained access to the email accounts of a limited number of its employees between January 17, 2020 and January 20, 2020.
Tandem is enhancing its email security controls, strengthening user authorization and authentication, and has changed its policies and procedures to limit the types of data that can be sent via email.
Click to expand...

[paywalled]
Medical Device Maker Faces California Privacy Suit After Breach
April 16, 2020
https://news.bloomberglaw.com/priva...er-faces-california-privacy-suit-after-breach

An insulin device maker allegedly failed to protect sensitive health data, leading to the exposure of more than 140,000 patients’ information in violation of California’s privacy law, according to a federal court complaint.
Tandem Diabetes Care Inc. announced in March that hackers accessed names, contact information, Social Security numbers, and clinical data regarding diabetes therapy, according to a complaint filed Thursday in the Southern District of California.

Plaintiff Jose Lopez, who bought an insulin pump and provided his data to Tandem, claims the company failed to timely notify patients about the breach. He also alleges Tandem failed to protect personal...
Click to expand...

guest · Apr 17, 2020

Privacy breach company remains part of B.C. health data sharing
No cause for concerns, say civil liberties and privacy observers
April 16, 2020
https://www.nsnews.com/privacy-breach-company-remains-part-of-b-c-health-data-sharing-1.24119457

A medical company hit by an October ransomware data privacy breach affecting 15 million Canadians is again named in a B.C. ministerial order as a company that can share British Columbians’ data.
The health data was hit by a cyberattack on LifeLabs, Canada’s largest medical laboratory diagnostic testing services company.

But, say observers, there is no issue for British Columbians to worry about as any liability rests with the government and not LifeLabs.

“The B.C. government understands the importance of protecting British Columbians’ personal information and has been working with LifeLabs to ensure the continued security of the information in our health information banks,” the Ministry of Health said in a statement.
“LifeLabs has been on the list of sources for personal information in B.C. health information banks for several years,” the ministry said.
Click to expand...

guest · Apr 17, 2020

Hartford HealthCare Hit by Valentine's Day Data Breach
April 17, 2020
https://www.infosecurity-magazine.com/news/hartford-healthcare-data-breach/

A US healthcare provider that serves 185 towns in Connecticut and Rhode Island has issued a data breach notification.
According to the notification, attackers gained access to patients' personal information after compromising email accounts belonging to two of Hartford HealthCare's more than 30,000 employees.

The healthcare provider said that up to 2,651 individual patients may have been affected by the incident. Information that malicious hackers got their hands on included patient names, dates of birth, clinical information, and health insurance information.

"The investigation determined that an unauthorized person gained access to two employees’ email accounts between February 13, 2020, and February 14, 2020," said a spokesperson for Hartford Healthcare.
Hartford HealthCare has required all employees to change their email passwords and has disabled "the software that the unauthorized person used to carry out the attack."
Click to expand...

guest · Apr 17, 2020

Oakland County stops COVID-19 data leak
April 16, 2020
https://www.freep.com/story/news/na...land-county-covid-19-data-leakage/5148194002/

Oakland County secured a data leakage of internal COVID-19 data that was used by the Oakland County Health Division for public health analysis.

The leaked data was circulated on WeChat, a social media messaging app.
The data that was leaked was "of a non-public map that was unintentionally marked as public during a recent upload," according to a release. The leak included information about positive coronavirus cases relating to gender, race, age, address and mortality status.

“Information security, especially around data critical to Health Division’s analysis during this pandemic, is of vital importance to the IT Department,” said Mike Timm, Oakland County’s director of information technology.
“We are taking additional precautions going forward including no longer sharing internal GIS data by link but rather within our own private environment.
Click to expand...

Log in or Sign up

Why Healthcare Security Matters

guest Guest

hawki Registered Member

Minimalist Registered Member

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

Dermot7 Registered Member

Minimalist Registered Member

guest Guest

FanJ Updates Team

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Log in or Sign up

Why Healthcare Security Matters

guest Guest

hawki Registered Member

Minimalist Registered Member

guest Guest

ronjor Global Moderator

guest Guest

guest Guest

Dermot7 Registered Member

Minimalist Registered Member

guest Guest

FanJ Updates Team

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

guest Guest

Useful Searches