Healthcare

April 15, 2024

Six months after an employee opened a phishing email sent by ransomware gang Medusa, a Colorado-based pathology laboratory is notifying more than 1.8 million patients that their sensitive information was compromised – one of the largest breaches reported by a medical testing lab to U.S. federal regulators to date.

Summit Pathology as of Thursday is already facing eight proposed federal class action lawsuits filed in the past week centering on the breach. The Summit incident ranks among some of the largest breaches reported by medical laboratory testing firms to date.

IT systems affected by the incident contained demographic and healthcare information, including names, addresses, medical billing and insurance information, diagnoses, dates of birth, Social Security numbers, and financial information.

October 2, 2024

“Weiser Memorial Hospital (“WMH”) recently experienced a cybersecurity incident involving our computer systems. Immediately upon learning of this activity, WMH took action to secure our environment and launched an investigation to better understand what information was potentially impacted. The investigation into the incident remains ongoing.” as reported on their Facebook page. “Further information will be released should Weiser learn of new developments during the ongoing investigation.”

The hospital dealt with weeks of downed computer systems and phone lines. In October 2024 the hospital admitted the outages were caused by a cyberattack and acknowledged that it was investigating the claims made by Embargo operators.

April 1, 2024

NorthBay Health, which operates two hospitals and multiple clinics in Solano County, has been the victim of a systemwide cyberattack. The hospital was forced to turn patients away and cancel appointments following the ransomware attack.

November 3, 2024

A ransomware attack on a prominent hospital in southwest Georgia knocked out access to the electronic health record system.

Memorial Hospital and Manor in the town of Bainbridge posted an urgent message on Sunday warning patients that the hospital’s IT team had discovered a ransomware attack the morning before when employees found notifications from the virus protection software.

“This impacts access to our Electronic Health Record system. While we believe this issue will not impact either the level or the quality of care we provide to our patients, we want to be fully transparent regarding this situation,” the hospital said.

The attack was claimed on Tuesday by the Embargo ransomware gang, which is trying to extort a ransom out of the hospital by threatening to leak 1.15 terabytes of purportedly stolen data by November 8.

February 3, 2024

Lurie Children’s Hospital in Chicago took IT systems offline after a cyberattack. The security incident severely impacted normal operations also causing the delay of medical care. Lurie confirmed that the attack disrupted the hospital’s access to the internet, email, phone services, and the MyChat platform. “The incident has impacted phones, emails, internet service, some elective surgeries and procedures even had to be canceled.”

February 21, 2024

Ransomware attack impacts more than 100 Change Healthcare services, including benefits verification, claims submission, and prior authorization. As soon as the breach was detected, Change Healthcare took the drastic step of disconnecting its systems to prevent further damage. Retail pharmacies, some now forced to revert to manual processing, face delays, sparking concerns among patients relying on timely medication.

The AHA (American Hospital Association) has advised health systems to disconnect from Change Healthcare and Optum services. This breach, reportedly due to hackers exploiting vulnerabilities in the ConnectWise ScreenConnect remote IT platform and using LockBit malware, underscores the vulnerability of consolidated healthcare data systems.

Update: “RansomHub leaked stolen data from United Health subsidiary Change Healthcare following a BlackCat/ALPHV attack, suggesting some form of collaboration between the two.” Change Healthcare paid $22 million in hopes of securing the stolen data