Actor Exploits Beaumont Health’s COVID-19 Vaccine Scheduling Tool

Patch Failure Leads to 7-Year Breach of Insurer

Florida Healthy Kids Corporation (FHKC) recently began notifying online applicants and enrollees of a serious data breach caused by its vendor failing to patch several website vulnerabilities. FHKC offers health and dental insurance for children throughout the state.

On December 9, FHKC was notified by it vendor, Jelly Beans Communications Design, that thousands of applicant addresses had been inappropriately accessed and tampered with through an FHKC website hosted by the vendor.

FHKC engaged a third-party cybersecurity firm to conduct a thorough review of the security incident, which found the website and subsequent databases held significant vulnerabilities that enabled the exploit.

“FHKC learned that its web hosting vendor had failed to apply security patches to its software, thereby exposing the website to vulnerabilities that were ultimately exploited by the hackers,” officials said in a statement.

Those flaws left the site vulnerable for seven years between November 2013 and when it was temporarily shut down by FHKC in December 2020.

As a result, a threat actor tampered with applicant addresses. The investigation could not rule out exposure of the other data included in the site, such as full names, dates of birth, contact details, Social Security numbers, financial information, family relationships, and secondary insurance information.

FHKC is reviewing its current security practices and policies to determine the best next steps for its security program, as well as expediting efforts to transition to a new vendor and website.

Ramsey County Reports Second Health Data Breach in Two Years

A ransomware attack on Netgain, a third-party technology services vendor, potentially breached the data belonging to 8,700 residents of Ramsey County, Minnesota.

According to the notice, Ramsey County officials were made aware of Netgain’s security incident on December 2. A hacker attempted to extort a ransom demand from the vendor, which impacted data within an application used by the county’s Family Health Division to document home visits.

The compromised data included names, contact details, dates of birth, dates of service, account numbers, health insurance information, and medical data. A small number of SSNs were also compromised during the incident.

Upon discovering the incident, Ramsey County immediately stopped using Netgain’s services and switched to backup processes. Officials also contact the Office for Civil Rights and local law enforcement, while consulting with other local governments impacted by the Netgain incident.

This is the second healthcare data breach faced by Ramsey County in the last two years. The first incident was an email breach that occurred in December 2018, where a hacker took control of 26 employee email accounts, including those in the social services department.

Ransomware Attack Hits Crisp Regional Health Services

Georgia-based Crisp Regional Health Services was hit with a ransomware attack on January 27, which impacted some of its systems, encrypted certain data, and shut down its phone lines, according to local news outlet WALB News 10.

The nursing team was the first to detect the flaws, as it encrypted some patient files. Upon discovery, the hospital engaged with a outside data security team to assist with the recovery and investigation.

The hospital also worked to secure information and enhance the security in place to ensure the integrity of the network and data. The phone lines were down for several days before the team restored the system. Patient care continued without interruption.

Notably, the care team employed a system of radios throughout the hospital to maintain access between departments. 

For now, the hospital is investigating the scope of the incident alongside law enforcement and its contracted security vendor.