Eskenazi Health Confirms Patient Data Was Stolen in August Ransomware Attack
Indianapolis, IN-based Eskenazi Health has announced it was the victim of a ransomware attack that was detected on or around August 4, 2021.
Suspicious activity was detected and the IT team immediately shut down systems to contain the attack. Emergency protocols were implemented, with staff reverting to pen and paper to record patient data. Without access to critical IT systems the decision was taken to go on diversion and ambulances were re-routed from Health & Hospital Corporation of Marion County to alternative facilities.
An investigation was launched to determine the nature and extent of the attack. Eskenazi Health said the forensic investigation determined the hackers had first gained access to its systems on May 19, 2021 and disabled its security systems to ensure their presence in the network was not detected. The intrusion was only detected when ransomware was deployed and files started to be encrypted.
The forensic investigators confirmed the attackers had been removed from its network and systems were secure. The initial investigation into the attack indicated patient information had not been accessed or stolen by the attackers. Eskenazi Health said it did not pay the ransom and was able to recover encrypted data from backups.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
On October 1, 2021, Eskenazi Health issued an update confirming new information had come to light confirming the gang behind the attack had exfiltrated files containing patient information from its systems. Some of those files have been posted on a dark web data leak site.
A review of the stolen data confirmed the files contained names, dates of birth, addresses, telephone numbers, email addresses, ages, driver’s license numbers, medical record numbers, passport numbers, Social Security numbers, face photographs, patient account numbers, credit card information, diagnoses, physician names, prescriptions, dates of service, health insurance information, and cause/date of death for deceased patients.
Notification letters are being sent to affected individuals and complimentary credit monitoring and identity theft protection services are being provided. The ransomware attack has been reported to the HHS’ Office for Civil Rights as affecting 1,515,918 individuals.
