Blue Springs Family Care Ransomware Attack Impacts 45,000 Patients
Blue Springs Family Care in Missouri has experienced a ransomware attack that has resulted in the encryption of sensitive data.
The attack was detected by the healthcare provider’s computer vendor on May 12, 2018. An investigation was launched the same day by the computer vendor with assistance provided by a contracted third-party computer forensics firm.
In contrast to many ransomware attacks which involve a single ransomware variant being downloaded and blind file encryption, the attacker managed to gain access to Blue Springs Family Care systems and installed a variety of malicious software programs in addition to the ransomware.
Those malware programs would have given the attacker full access to all Blue Springs Family Care computer systems, including access to all patients protected health information. At the time of issuing notifications to patients, Blue Springs Family Care had not received any reports to suggest that any PHI was stolen and misused by the attacker. However, data access and data theft could not be ruled out.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The types of information potentially accessed included full names, home addresses, dates of birth, Social Security numbers, account numbers, driver’s license numbers, disability codes, and diagnoses.
The computer forensics firm was able to quarantine the entire system and prevent any further unauthorized data access. New software has now been installed which monitors for unauthorized access, and a new intrusion prevention system has also been implemented, which includes a new firewall.
Additionally, Blue Springs Family Care is changing over to a new electronic medical record system that encrypts all data at rest to ensure PHI cannot be accessed in the event that another data breach is experienced.
The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights indicates 44,979 patients were affected by the breach.
