107,000 Ferguson Medical Group Patients Impacted by Ransomware Attack
Saint Francis Healthcare System has announced that the computer network of Ferguson Medical Group has been attacked with ransomware.
The attack occurred on September 21, 2019, before Saint Francis Medical Center acquired the Sikeston, MO-based medical group. Saint Francis Healthcare learned about the ransomware attack on September 21.
According to a notice on the Saint Francis Healthcare website, the attackers succeeded in encrypting medical records of all patients who had received medical services at Ferguson Medical Group prior to January 1, 2019. The incident was reported to the Federal Bureau of Investigation and steps were immediately taken to isolate the affected systems.
The attackers demanded payment of a ransom for the keys to decrypt files on the network. Since there was no guarantee that the attackers were able to supply working decryption keys and due to other uncertainties, the decision was taken not to pay and to instead recover files from backups.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
While many files were recovered, some information could not be restored and has been permanently lost. It was not possible to recover any documentation that had been scanned and saved on its systems, and medical records for patients who received services at Ferguson Medical Group between September 20, 2018 and December 31, 2018 were also permanently lost.
An analysis of the attack uncovered no evidence to suggest the attackers obtained files containing the protected health information of patients prior to encryption and there have been no reports received to suggest any patent information has been misused. However, since it is not possible to rule out unauthorized data access and theft, affected patients have been offered complimentary credit monitoring and identity theft protection services.
The incident has been listed on the Department of Health and Human Services’ Office for Civil Rights breach portal. The breach summary indicates 107,054 Ferguson Medical Group patients have been affected. It is not clear how many of those patients have had some or all of their health information lost as a result of the attack.
