Broward Health, a Florida-based healthcare system, has disclosed a data breach affecting 1,357,879 people.
The organization offers a wide range of medical services in more than thirty locations and receives more than 60,000 admissions annually.
See also: Malicious Telegram installer installs Purple Fox malware on infected machines
Broward Health disclosed a cyberattack, which took place on October 15, 2021. An attacker was able to gain access to the hospital's network and patient and employee data.
The organization appears to have discovered the intrusion four days later, on October 19, and immediately notified the FBI and the US Department of Justice.
All employees were immediately notified and asked to change their user passwords. Additionally, Broward Health hired a third-party cybersecurity expert to assist in the investigation.
The investigation revealed that the attackers gained access to patients' personal and medical information, which may include: full name, date of birth, phone number, email address, home address, social security number, medical information and history, health condition, treatment and diagnosis, financial or banking information, and driver's license number.
See also: The Lapsus$ ransomware gang “hit” the media company Impresa
Broward Health confirms that the attackers gained access to the above data, however, it notes that there is no evidence that this data has been used in any way.
The breach was likely carried out through a third-party provider who was allowed access to the system to provide its services.
“In response to this incident, Broward Health is taking steps to prevent similar incidents from happening again. These include ongoing investigation, password resets, enhanced security measures across the enterprise, and implementing multi-factor authentication for all users of the systems,” explains in its data breach notification.
See also: Microsoft: Hotfix for 2022 bug in Exchange
Due to the critical nature of the exposed data, recipients of the alerts should remain vigilant and be careful with the emails and messages they receive. Their details could be used for further attacks (phishing etc.).
Additionally, the healthcare system offers identity theft detection and protection services through Experian to affected individuals.
Source: Bleeping Computer
