Stony Brook University Hospital on Long Island has issued a security alert to inform its patients that their personal data may have been exposed following a ransomware attack. Specifically, Stony Brook has sent a letter to patients to inform them of a potential data breach, which comes as a result of the attack that took place last May at “Blackbaud”, a supplier to the hospital.
Blackbaud is a provider of software for nonprofits, universities, healthcare organizations, foundations and other entities worldwide.
Stony Brook was notified by Blackbaud on July 17 that patient information may have been compromised in a security incident on systems .
Hospital patients have been notified that data in Blackbaud systems affected by the cyberattackmay include information such as names, dates of birth, addresses, contact information, the patient's. However, Stony Brook emphasized to patients that it did not provide their Social Security number, bank account information or credit card information to Blackbaud, and therefore this information is not included in records located in the potentially affected systems.
Additionally, Blackbaud assured the hospital that the data stolen in the attack was destroyed and was not used, sold or distributed. The hospital added that Blackbaud assured it there was no reason to worry that the information involved in this incident was used maliciously.
The 624-bed hospital stressed that the hackers did not gain access to any Stony Brook systems, including medical systems or electronic health records, during the Blackbaud attack. Stony Brook said it will notify patients — for whom it has a valid email address — who may be affected individually. However, it did not specify how it plans to contact patients who did not have a valid email.
Therefore, patients are advised to regularly monitor any statements they receive from their health plans or healthcare providers and check for any unfamiliar health services.
Finally, Stony Brook said that following the potential data breach, it plans to take additional security measures, while conducting research and oversight of its suppliers to ensure that something like this does not happen in the future.
