A hospital in Southern California says malicious hackers have accessed information about donations and specific patients, but they don't believe the information has been released publicly.
Like many other nonprofits and medical providers, Methodist Hospital of Southern California uses Blackbaud Inc. to host the foundation's fundraising platforms.
Blackbaud fell victim to a ransomware attack between February and May 2020, when hackers stole data from the company's network and then threatened to lock down access to the company and that of hundreds of its customers unless a ransom .
Blackbaud's cybersecurity team was able to prevent the attackers from locking up its data, but the cybercriminals managed to get away with a copy of their own .
Donor information, along with a limited amount of patient information, from Methodist Hospital of Southern California was part of the subset of stolen data, the hospital's press release said.
Although the hackers only had access to the hospital's institutional information, they may have seen the patients' full names, phone numbers, emails, dates of birth, genders, medical record numbers and possibly the hospital admission date, the press release says.
Working with law enforcement, Blackbaud said it paid the ransom to gain access to its files and received confirmation that the copy of the files had been destroyed.
“Blackbaud has assured Methodist Hospital of Southern California that it has no reason to believe that data beyond this cybercrime was released to the public,” the hospital’s news release states.
Blackbaud hired a team of third-party experts to monitor the dark web – a part of the internet hidden from the general public where compromised information is sold or offered for free – to ensure that the data is not disseminated further.
Attacks like these have become more common in recent years, as hackers have turned their attention to vulnerabilities in corporate and government networks, stealing data and locking companies out of their own systems unless they pay the ransom they are demanding.
If they refuse to pay, these so-called ransomware gangs publish the data publicly on the dark web, ZDNet reports. Most choose to pay, despite concerns that doing so may simply encourage hackers to carry out more attacks in the future.
Source of information: pasadenastarnews.com
