Inova Health Systems has sent letters to its patients to inform them of a cyber attack that may have led to a breach of their personal data.
The attack was carried out against Blackbaud, a third-party service provider used to raise money and donations from non-profit institutions and universities worldwide.
Blackbaud fell victim to a ransomware, which took place between February and May of this year.
Inova released a statement saying that malicious actors obtained some of the personal information of patients and donors.
Social Security numbers and financial account information were not affected. But the ransomware attackers may have gained access to names, addresses, phone numbers, and medical departments visited by patients.
Inova has sent letters to thousands of patients and is asking anyone with questions to visit the Inova Health website.
Inova Health's full statement regarding the incident reads as follows:
Inova Health System has been notified by Blackbaud, a third-party service provider used for fundraising or donor engagement efforts by nonprofits and universities around the world, of a widespread data security incident affecting Inova Health System and many of Blackbaud’s customers around the world. Blackbaud was the target of a ransomware attack that occurred between February 7, 2020, and May 20, 2020. As a result of this incident, hackers obtained some of our patient and donor personal information. Blackbaud assured us that it has fixed the vulnerability that allowed the incident and that it is improving security controls and conducting ongoing efforts to prevent such incidents in the future. According to Blackbaud, there is no evidence that the data will be misused, distributed, or otherwise disclosed.
Inova takes the security of personal information very seriously. Upon being notified of the incident by Blackbaud, we immediately launched a thorough investigation, working with leading cybersecurity professionals ,to determine who may have been affected and notify them. Importantly, this incident does not affect social security numbers, financial account information, and/or payment card information.
