Alex - stock.adobe.com

News

Montana Medical Center Faces Hacking Incident Impacting 214K

Logan Health Medical Center suffered a hacking incident that impacted nearly 214K individuals as hacking incidents increase across the healthcare sector.

Jill McKeon
By
Published: 25 Feb 2022

Healthcare data breaches continue to burden the healthcare sector. As geopolitical tensions rise due to Russia’s invasion of Ukraine, the American Hospital Association (AHA) warned that US healthcare organizations may become collateral damage in Russian cyberattacks.

Meanwhile, Log4j vulnerabilities continue to overwhelm the already overburdened cybersecurity workforce. Although no significant cybersecurity incidents relating to the vulnerabilities have been reported, Log4j put a significant strain on the cybersecurity workforce that will likely have long-term consequences, a survey from (ISC)² suggested.

Recently reported healthcare data breaches summarized below further validated the ongoing trend of data breaches and cyberattacks aimed at small or mid-size healthcare facilities.

Logan Health Medical Center Hacking Incident Impacts 214K

Logan Health Medical Center in Kalispell, Montana suffered a hacking incident that impacted 213,543 individuals, according to the Maine Attorney General’s Office. Logan Health discovered suspicious network activity on November 22, 2021, and later found evidence of unauthorized access to one file server containing information about patients, employees, and business associates.

Specifically, the unauthorized actor may have had access to Social Security numbers, names, email addresses, phone numbers, and birth dates. Logan Health began notifying impacted individuals of the event on February 22.

Logan Health said it was working to implement additional security safeguards and employee training in light of the incident, as well as providing 12 months of identity monitoring services to impacted individuals.

“This event is a painful reminder that each of us plays an important role in protecting our patients’ private health information,” Logan Health’s letter to victims stated.

“Securing logins and passwords, not clicking on unfamiliar links and being mindful of locations for storing sensitive information are important safeguards that should be followed at all times.”

Hawaii Orthopedic Practice Suffers Ransomware Attack

Minimally Invasive Surgery of Hawaii, also known as Orthopedic Associates of Hawaii, All Access Ortho, and Specialty Suites, issued a data breach notification to an undisclosed number of patients on February 14, 2022, just over a year after it suffered a ransomware attack.

On February 19, 2021, the practices discovered that an unauthorized individual had encrypted its systems and deployed ransomware. On April 2, the practices determined that the unauthorized actor had exfiltrated data. However, Minimally Invasive Surgery of Hawaii said it was “unaware that any of the information was actually misused or disseminated by the unknown actor.”

The ransomware attack potentially exposed names, birth dates, health insurance information, treatment and diagnosis information, driver’s license numbers, financial account information, payment card information, and some Social Security numbers.

“The Practices take this event and the security of your information seriously. Upon learning of this event, we immediately took steps to restore our operations and further secure our systems,” the notice stated.

“As part of our ongoing commitment to the privacy of personal information in our care, we reviewed our existing policies and procedures and implemented additional administrative and technical safeguards.”

Jax Spine & Pain Center Faces Ransomware Attack

Florida-based Jacksonville Spine Center, also known as Jax Spine & Pain Center, suffered a ransomware attack on January 24, 2022, that impacted 38,000 individuals. Cybercriminals targeted an inactive server that maintained patient files created before May 2018.

“The criminals threatened to publish the stolen files online unless a ransom was paid,” Jax Spine & Pain Center said in its statement.

“Our current main network server is cloud-based and was not impacted during this ransomware attack. Patient files created after May 2018 are maintained in the cloud and remain safe and secure. It is also important to note that no clinical data was accessed by the attackers; they only obtained demographic data.”

The ransomware attack potentially exposed names, Social Security numbers, addresses, and birth dates. The orthopedic center is still investigating the incident and has not yet notified all impacted individuals.

“Please understand that this process is ongoing and we are doing everything possible to identify the extent of the breach and notify affected patients as soon as possible,” the notice stated.

Next Steps

Dig Deeper on Healthcare data breaches