Colonial Behavioral Health & Veterans Health Administration Patients Affected by Ransomware Attacks
Colonial Behavioral Health and a medical transcription service provider used by the Veterans Health Administration have experienced ransomware attacks that potentially involved patient data theft.
Colonial Behavioral Health
Colonial Behavioral Health, a behavioral health and psychiatric service provider in the Greater Williamsburg Area of Virginia, has fallen victim to a ransomware attack. The attack was detected on or around October 4, 2024, when access to files and systems was disrupted. Immediate action was taken to contain the attack and prevent further unauthorized access to its systems and third-party cybersecurity experts were engaged to investigate the incident.
Initial access to the network was gained on or around May 17, 2024, and ransomware was deployed on or around October 4, 2024. During the four and a half months that the threat actor had access to its systems, it is possible that data was exfiltrated. Files were reviewed to determine the types of data involved and it was confirmed that the personal and protected health information of 29,930 patients had potentially been viewed or stolen. The exposed data varied from individual to individual and may have included one or more of the following:
- Names, addresses, ZIP codes, dates of birth
- Social Security numbers, driver’s license numbers, and/or similar identifiers
- Clinical information such as diagnoses/conditions, lab results, medications, and/or other treatment information
- Insurance or claims information, and information related to guarantors who paid bills for others.
Colonial Behavioral Health said it is reviewing its security measures and is evaluating additional actions to strengthen network security. The affected individuals were notified by mail on November 27, 2024, and were offered complimentary credit monitoring services. The HHS’ Office for Civil Rights breach portal indicates 29,930 individuals were affected.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Veterans Health Administration
The Veterans Health Administration (VHA) has notified 2,302 veterans that some of their protected health information has been exposed in a data breach at a medical transcription vendor. VHA said a threat actor gained access to a server at its vendor, DBP, Inc., in an apparent ransomware attack, and files containing veterans’ data were potentially copied.
The threat actor did not access medical record information in the VA electronic health record system but files on the server did contain veterans’ names, medical record information, and Social Security numbers. The breach affected veterans who received healthcare services at the VA Amarillo Healthcare System (1,069), VA Minneapolis Healthcare System (616), VA Boston Healthcare System (386), VA Togus Healthcare System (144), VA Connecticut Healthcare System (37), and the Baltimore VA Medical Center (25). DBP said it has purchased new hardware and will implement additional security measures to prevent similar attacks in the future.
