On August 26, 244,813 patients were notified that their personal data had potentially been compromised in a ransomware against Assured Imaging, an Arizona-based provider of mobile digital mammography.
The attack resulted in a data leak. Although it has not yet been determined what this data is, the attacker could have accessed patient names, contact information, medical history, patient identifiers, services provided, and other sensitive information.
The creators of Pysa or Mespinoza ransomware claimed responsibility for the attack a few weeks later. They even published some of the data they allegedly stole, in an attempt to force Assured Imaging to pay the ransom.
Patients affected by the breach filed a lawsuit in the U.S. District Court of Arizona, which alleges that the victims suffered damages in a variety of areas.
The lawsuit also alleges that Assured Imaging stores patient data on a system that is vulnerable to cyberattacks and that the breach was foreseeable. As a result of these security lapses, patient data was left vulnerable.
Finally, the lawsuit alleges that Assured Imaging failed to comply with FTC guidelines and minimum standards for data security, including implementing all security updates, training and supervising employees on the proper handling of incoming emails, implementing policies and procedures to limit access to patient health information, and failing to encrypt ePHI, among other allegations.
“There is a high probability that entire sets of stolen information have been leaked onto the black market, and there is much that has not yet been leaked onto the black market, meaning patients are at increased risk of fraud and identity theft for many years to come,” according to the lawsuit. “Thus, patients should carefully monitor their financial and medical accounts for many years to come.”.
