Breach Notification
,
Healthcare
,
Industry Specific
Attack Detected in Mid-April But Hackers Accessed, Acquired Patient Files in March
A Tennessee-based cardiac care clinic is notifying more than 170,000 patients and others that hackers may have stolen their sensitive personal and medical information in a cyberattack detected in April. The Karakurt cybercrime group claimed credit for the hack a month later.
In a report filed to Maine’s attorney general on Friday, The Chattanooga Heart Institute said that on April 17 it saw indications of a cyberattack on its IT network. The incident affected a total of 170,450 individuals, including five Maine residents, the clinic said.
The entity, which includes three vascular surgeons and 27 cardiologists at four locations in Tennessee and one in Georgia, said in a breach notice posted on its website that a forensics investigation into the incident had determined that an “unauthorized third party” gained access to its network about a month earlier, between March 8 and March 16.
“Upon discovering the unauthorized third-party access, The Chattanooga Heart Institute took quick action to protect its systems, contain the incident, begin an investigation and maintain continuity of care,” the clinic’s breach notice said.
The Chattanooga Heart Institute also notified federal law enforcement, it said. “Once secured, systems were returned to the network with additional security and monitoring tools.”
On May 31, The Chattanooga Heart Institute learned the hackers had obtained files from its systems containing copies of confidential patient information, the notice said.
While medical information was among the data affected, the incident did not involve data retrieved directly from the clinic’s electronic medical record system, The Chattanooga Heart Institute said in its report.
While the investigation is still ongoing, to date, the information identified as being compromised in the breach belongs to patients or their guarantors, the clinic said. It includes name, mailing address, email address, phone number, birthdate, driver’s license number, Social Security number, account information, health insurance information, diagnosis, medical condition, lab results, medications and other clinical, demographic or financial information, the clinic said.
“Notification letters to individuals whose data may be involved will begin to be sent out by U.S. mail over the coming weeks as the detailed review of each file is completed,” the clinic said. The Chattanooga Heart Institute will offer complimentary identity and credit monitoring services to those affected, it said.
Blog site DataBreaches.net reported that in May, Karakurt threat actors had claimed to have attacked The Chattanooga Heart Institute and to have exfiltrated 158 gigabytes of patient and employee data, but that the cybercrime group did not post proof of its claim on the dark web.
Karakurt was the subject of an alert last August by HHS’ Health Sector Cybersecurity Coordination Center.
At that time, HHS warned that the “relatively new cybercrime group” had carried out attacks globally, including against several U.S.-based healthcare and public health sector entities. Among those attacked were an assisted living facility, a dental firm, a healthcare provider and a hospital, the alert said (see: As Attacks on Healthcare Continue, Feds Warn of New Threats).
The Chattanooga Heart Institute did not immediately respond to Information Security Media Group’s request for additional details about the incident.
Similar Recent Incidents
As of Tuesday, The Chattanooga Heart Institute incident was not yet posted on the Department of Health and Human Services’ Office for Civil Rights’ HIPAA Breach Reporting Tool website listing health data breaches affecting 500 or more individuals.
The institute is among a number of other major incidents in recent months involving the exfiltration of patient data.
Those include Tampa General Hospital, a not-for-profit private hospital that has 1,040 beds and 8,000 employees and serves a dozen counties with a population of more than 4 million people. Last week, the hospital said it had been notifying 1.2 million patients of a thwarted ransomware encryption attack.
That incident, which the hospital said it detected in May, also involved exfiltration of protected health information (see: Florida Hospital Says Data Theft Attack Affects 1.2 Million).
Nine of the 10 largest HIPAA breaches posted so far this year to the HHS OCR’s website were reported as hacking/IT incidents, including several ransomware and exfiltration incidents (see: Mid-Year Health Data Breach Analysis: The Top Culprits).