Three healthcare providers in New York, Florida and Georgia are informing patients that their protected health-related information may have been exposed following recent cyberattacks carried out by unknown hackers.
Specifically, warnings were issued to patients at Advanced Urgent Care of the Florida Keys on November 6 regarding a ransomware attack that took place on March 1, 2020. According to a breach notification issued by the medical center, patient data was compromised after hackers encrypted files on a backup drive.
As reported by Infosecurity Magazine, information exposed as a result of this malicious activity includes names, dates of birth, health insurance information, medical care information, medical diagnostic information, laboratory results, medical record numbers, Medicare or Medicaid beneficiary numbers, medical billing information, bank account information, credit/debit card information, CHAMPUS numbers, driver's license numbers, signatures, and social security numbers.
Additionally, in Katonah, New York, a ransomware attack on September 1 at Four Winds left staff unable to access the computer systems for about two weeks.
Security experts hired to determine the scope and impact of the attack found that hackers were able to gain access to password-protected files, and patient lists dating back to 1983 may have been compromised. These lists include personal patient information such as names, medical record numbers and Social Security numbers.
Four Winds has not yet disclosed how many patients may have been affected by the attack. The hospital said that investigators have determined after an investigation that the cybercriminals deleted the files they had in their possession, but that this cannot be verified. The hospital also stressed that it has taken steps to prevent a similar attack in the future.
The hackers also demanded a ransom from Galstan & Ward Family and Cosmetic Dentistry in Suwanee, Georgia , after its computer systems were infected. Galstan & Ward had previously hired a third-party vendor to take down the server in question and restore its data from a backup after detecting suspicious activity.
On September 11, 2020, the hospital discovered that some of its records had been stolen and posted on the dark web. However, these did not include patient information. However, the hospital has informed patients about the incident.
The attacks on the three healthcare providers add to a long list of hospitals that have been hit by hackers, particularly since the outbreak of the COVID-19.
