1M Inova Health Individuals Added to Blackbaud Breach Victim Tally

The Blackbaud breach victim tally has climbed to nearly 3 million healthcare-connected entities and other nonprofits. In the last week, Inova Health System reported more than 1 million individuals were affected by the incident, as well as several other healthcare provider organizations. 

Blackbaud, a cloud computing vendor for a range of nonprofits, foundations, corporations, education institutions, healthcare entities, and change agents, reported that its self-hosted environment was hit with a ransomware attack on May 14. 

The cyberattack was stopped six days later, but the incident lasted between February 7 and May 20, 2020. The hackers stole a subset of data during the attack before Blackbaud was able to shut the attackers out of the system. And officials said they paid the ransom “with confirmation that the copy they removed had been destroyed.” 

In mid-August, Northern Light Health Foundation in Maine became one of the first reported victims in healthcare with about 657,392 donors, potential donors, and patients who supported the foundation affected by the breach. 

During the first week of September, at least six more healthcare entities had been added to the Blackbaud victim tally: Saint Luke’s Foundation (360,212), MultiCare Foundation (300,000 total individuals, of which 179,189 are patients), Spectrum Health (52,711), Northwestern Memorial HealthCare (55,983), and Main Line Health (60,595). 

Inova Health System in Virginia has since been added to the tally with 1.05 million affected individuals, making it the hardest hit healthcare entity, thus far. Officials said Blackbaud notified Inova about the incident in July and launched its own investigation with assistance from a third-party cybersecurity firm. 

On August 10, the investigation determined the data exfiltrated by the hackers contained  the personal information of some patients and donors, including names, contact details, dates of birth, provider names, dates of service, department visited, and or the philanthropic giving history, such as the dates and amounts. 

Social Security numbers, financial accounts, and payment information were not taken during the attack. 

California-based Enloe Medical Center was also affected by the Blackbaud incident. Officials said they launched an independent organization and found the hacker obtained patient names, contact information, medical treatment discharge dates, and departments visited. Some patient dates of birth, phone numbers, and or email addresses were also compromised during the attack. 

The number of impacted patients has not yet been posted on the Department of Health and Human Services breach reporting tool. 

The Blackbaud breach also claimed the data of about 93,000 patients from Roper St. Francis Healthcare, including patient names, ages, genders, dates of birth, contact details, departments of service, and provider names. 

The data of about 348,000 patients of NorthShore University Health System in Illinois was compromised in the attack, as well, and limited to names, dates of birth, and some clinical information. 

About 163,000 donors, who were previous patients, to the University of Kentucky HealthCare were also affected by the Blackbaud incident, which included names, contact information, medical record numbers, service department, provider names, admission dates, and dates of birth. 

The Guthrie Clinic, a member of the Mayo Clinic Care Network, was also affected by the Blackbaud incident, which compromised the data of 92,064 patients. The data included names, contact details, age, gender, dates of treatment, departments of service, treating providers, and health insurance status. 

The clinic is currently examining its vendor relationship with Blackbaud and evaluating their security safeguards. 

Lastly, about 165,000 Atrium Health patients were affected by the Blackbaud incident. The exfiltrated data included names, contact details, demographic information, patient IDs, dates of treatment, locations of service, and treating physician names. 

And if the patient donated to the provider, the date and amount of donation may also have been included in the breached data. 

With the added victims, the Blackbaud ransomware attack is by far the largest healthcare data breach of 2020. Notably, last year’s largest breach was also vendor-related and had a rippling effect across healthcare. The American Medical Collection Agency breach impacted more than 25 million patients from dozens of providers.