Another COVID-19 Research Firm Targeted by Ransomware Attack

Healthcare Vendor EVERSANA Reports 2019 PHI Breach

Wisconsin-based EVERSANA recently reported it fell victim to a protected health information data breach that occurred between April 1 and July 3, 2019.  EVERSANA is a commercial services vendor to the healthcare sector.

According to the notice, EVERSANA launched an investigation into unusual activity discovered on its email accounts in 2019 with assistance from a third-party cybersecurity firm. Officials did not disclose when the activity was first discovered, nor when the investigation was launched.

The investigation revealed several email accounts were compromised through a hack of its legacy technology environment during the three-month period. As a result, “a limited number” of patient services data was potentially accessible. EVERSANA has since updated the outdated tech and implemented additional security measures.

The compromised data varied by patient but could include names, contact information, Social Security numbers, driver’s licenses or state identification numbers, passports, tax identification numbers, financial account data, debit or credit card information, user credentials, health data, treatments, diagnoses, provider names, MRN/patient ID number, Medicare/Medicaid number, health insurance data, and prescription details.

Impacted patients will receive a year of free credit monitoring and identity restoration services.

On February 7, EVERSANA concluded its investigation. It’s crucial to point out that if the data was covered by HIPAA, the vendor had just 60 days to report the breach to the Department of Health and Human Services after the breach was discovered – not at the investigation’s conclusion.

Otis Bowen Center for Human Services’ Email Hack

Otis Bowen Center for Human Services in Indiana is notifying 35,804 patients that their data was potentially compromised after a hack on two employee email accounts.

On January 28, the Bowen Center discovered some patient and employee data was potentially exposed to an unauthorized user, as officials were performing an independent digital forensics investigation. Officials said they launched a review of the security incident to determine what patient information was impacted.

The notification did not provide further information into the event, such the duration of the compromise, specifics into the hack, and when the attack began. Bowen Center has since enhanced the security of its digital environment.