A ransomware attack that occurred months ago has now been credited to compromise medical information of more than 40,000 patients of Sioux City healthcare institutions.
Officials from the Jones Eye Clinic and its affiliated institution, CJ Elmwood Partners, believe that the attack accessed information of patients whose registration stretched from 1st January 2003 to 23rd August 2018.
The attack was originally discovered on 23rd August by the personnel. The company immediately started implementing ransomware removal and recovery processes. The restoration was successful thanks to backups. Hence, the company averted the need to pay any ransom for ransomware removal. However, the institutions still contacted and notified authorities including FBI. Hiring commenced for a forensic investigation so the attack vectors and the impact of the attack could be determined.
The forensic investigation concluded that the ransomware succeeded to enter the company systems’ on 22nd August. The investigation also stated that the cybercriminals involved in the attack gained access to sensitive patient data. This information was stored by the scheduling software –– used for arranging and managing patient appointments and the billing software –– used for charging patients.
The compromised data included personal information like names, residences, birth history as well as the patient’s medical history. Unfortunately, some patients were unluckier as their insurance data and SSN were also accessed. Fortunately, financial information like credit card numbers was not compromised. So far, there have no pointers regarding the exploitation of stolen data.
The patients of both the healthcare institutions have been made aware of the attack. Additionally, in order to protect them from any criminal activity, they have been consulted so they could detect and tackle any criminal activity. Furthermore, both institutions have agreed to provide these patients with an opportunity for enrollment in free credit monitoring services that go for about a year. Payment for these patients will be provided till 19th January.
