New York-based Practicefirst disclosed a data breach that compromised personally identifiable information (PII) of patients and employees.
According to the healthcare practice management provider, a ransomware attack carried out in 2020 could have exposed the personal information of patients and employees but added that it was not aware of any fraudulent activities or misuse of the information.
When it detected suspicious activity in December 2020, the vendor immediately shut down all IT systems, changed passwords, and notified authorities.
“We immediately reported the incident to appropriate law enforcement authorities and implemented measures to further improve the security of our systems and practices,” the company’s statement explained.
According to the investigation initiated by the company, the hacker managed to steal files and then deployed ransomware and encrypted servers that contained the personal information of patients and employees.
As a result, Social Security numbers, birthdates, driver’s license numbers, physical addresses, phone numbers, and email addresses were exposed.
“We worked with a leading privacy and security firm to aid in our investigation and response… We also implemented additional security protocols designed to protect our network, email environment, and systems.”
Individuals impacted by the incident were notified, and Practicefirst provided an assistance line to address their concerns.
There has been an increase in attacks on health and educational institutions around the globe, resulting in large data breaches. University Medical Center in Nevada was the latest target of a ransomware attack by the REvil ransomware gang, a notorious hacker group that performs high-impact attacks on various companies and organizations, mainly in the US.
And recently, a former employee at Aultman Health Foundation in Ohio was charged with HIPAA violations and repeatedly accessing over 7,000 patient records.
