Benefytt, EMSA, Lindsay Municipal Hospital Affected by Cyberattacks
Health Plan Intermediaries Holdings (Benefytt) has been affected by a cyberattack on a vendor, Emergency Medical Services Authority said patient data was exposed in a February cyberattack, and the Bian Lian group has claimed responsibility for a cyberattack on Lindsay Municipal Hospital.
Patient Data Stolen in Cyberattack on Emergency Medical Services Authority
The Emergency Medical Services Authority (EMSA) in Oklahoma City, OK, has announced that it fell victim to a cyberattack that saw unauthorized individuals gain access to its network between February 10, 2024, and February 13, 2024. The intrusion was detected on February 13, 2024, and systems were shut down to prevent further unauthorized access. The forensic investigation confirmed that the attackers exfiltrated files containing patient data including names, addresses, dates of birth, dates of service, and, for some individuals, the name of their primary care provider and/or Social Security number.
Notification letters have started to be mailed to the affected individuals and complimentary credit monitoring and identity theft protection services have been offered to individuals who had their Social Security numbers exposed. The EMSA data breach has affected 611,743 individuals.
Bian Lian Hacking Group Claims Responsibility for Lindsay Municipal Hospital Cyberattack
Lindsay Municipal Hospital in Oklahoma has recently reported a hacking incident to the HHS’ Office for Civil Rights (OCR) that has affected 500 individuals, a number that is commonly used as a placeholder to meet the breach reporting requirements of the HIPAA Breach Notification Rule when the number of affected individuals has yet to be confirmed.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Aside from the report to OCR, Lindsay Municipal Hospital has remained quiet about the cyberattack and data breach; however, the group behind the attack has not. The Bian Lian hacking group has claimed responsibility for the attack and added Lindsay Municipal Hospital to its data leak site, including evidence to support its claims.
Bian Lian has been in operation since at least 2021 and favors attacks on healthcare providers, manufacturing companies, and law firms, where there is greater potential for a high ransom payment. The group engages in double extortion tactics, where data is stolen, and payment is required to prevent the release of that data and to obtain the keys to decrypt encrypted files. The listing states that the stolen data will be uploaded soon. It is unclear whether Lindsay Municipal Hospital is negotiating with the group.
Health Plan Intermediaries Holdings (Benefytt) Affected by Cyberattack on Vendor
Health Plan Intermediaries Holdings, which operates as Benefytt, has recently confirmed that it was affected by a data breach at a business associate of its vendor, Multiplan Inc. Multiplan used the law firm, Orrick, Herrington & Sutcliffe, LLP, which suffered a ransomware attack. Benefytt said its systems and those of Multiplan were unaffected; however, data provided to the law firm to perform its contracted duties was exposed and potentially compromised. The cyberattack was detected on March 13, 2023, and on March 10, 2023, Orrick, Herrington & Sutcliffe confirmed that files containing sensitive data had been stolen. Benefytt said neither MultiPlan nor Orrick could determine which health insurance plans were affected, and that it has been working with the two firms to obtain the necessary information to issue notifications.
Benefytt said it is notifying all affected individuals and is offering them complimentary credit monitoring services. Orrick, Herrington & Sutcliffe reported the breach to the HHS’ Office for Civil Rights on June 30, 2023, as affecting 40,823 individuals; however, the total was revised upwards to 152,818 individuals, and the notification to the Maine attorney General in December 2023 states that 637,620 individuals were affected. It is currently unclear how many Multiplan/Benefytt health plan members have been affected.
