HealthEC LLC, a provider of health management solutions, suffered a data breach affecting nearly 4.5 million people. Essentially, the individuals affected are individuals who had received services through one of HealthEC’s clients.
HealthEC provides a population health management (PHM) platform that healthcare organizations use for data integration, analytics, care coordination, patient , etc.
See also: Xerox: Subsidiary XBS US fell victim to ransomware attack and data breach
On December 22, the company revealed that it had suffered a data breach that took place over the summer (between July 14 and 23, 2023). The attackers gained access to some of the company's systems. After the discovery of the incident, an investigation was launched which was completed on October 24, 2023 and revealed that the attacker had stolen files containing the following data:
- Name
- Address
- Date of birth
- Social Security Number
- VAT number
- Medical Record Number
- Medical information (diagnosis, diagnosis code, mental/physical condition, prescription information and provider name and location)
- Health insurance information (beneficiary number, subscriber number, Medicaid/Medicare ID)
- Billing and claims information (patient account number, patient ID number and treatment cost information)
Because of the nature of the breached data, HealthEC advises users to be especially cautious of possible emails, messages or calls they may receive. Attackers may use this information to deceive them.
The company says that if anyone spots suspicious activity they should immediately report it to the appropriate authorities, “including an insurance company, healthcare provider, and/or financial institution.”
See also: EasyPark: Data breach may affect millions of users
During the time of the cyberattack, HealthEC did not specify how many individuals were affected by the data breach. However, a filing with the office of the Maine Attorney General concerning only one of the company's clients, MD Valuecare, set the number of affected individuals at 112,005.
A new listing that appeared most recently on the U.S.states that the total number stands at 4,452,782.
There are 17 state-level healthcare providers and systems health that were affected by the HealthEC cyberattack.
Some major organizations mentioned in the announcement include Corewell Health, HonorHealth, Beaumont ACO, State of Tennessee – Division of TennCare, the University Medical Center of Princeton Physicians’ Organisation and the Alliance for Integrated Care of New York.
Health- related data breaches can have serious consequences for patients and healthcare providers. For patients, a breach of their data can lead to a loss of trust in their healthcare provider, as well as increased risk to their privacy.
See also: R00TK1T: Data breach at Qatar Airways!
Additionally, data breaches can lead to misuse of patients’ personal and medical information, such as fraud or identity theft. This can have serious financial and personal consequences for patients.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
For healthcare providers, data breaches can lead to significant financial losses due to fines and costs associated with remediating the breach.
Additionally, breaches can damage a provider’s image and reputation, which can lead to a loss of customers and patients. This can have long-term consequences for their business.
Finally, health data breaches can create legal liabilities for healthcare providers, as patients can bring lawsuits for the violation of their privacy.
Source: www.bleepingcomputer.com
