HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Hacker Steals PHI of 23,000 Patients of Prosthetic and Orthotic Care

Prosthetic and Orthotic Care (POC), an independent prosthetics and orthotics company serving disabled individuals in Southern Illinois and Eastern Missouri, has discovered that an unauthorized individual has stolen the protected health information of 23,015 patients.

The cyberattack occurred in June 2016, although POC only became aware of the hacking incident on July 10. The hacker gained access to patient data by exploiting security flaw in a third party software system that had been purchased by POC. The attack was conducted by a hacker operating under the name – TheDarkOverlord – who was also responsible for the cyberattacks on Athens Orthopedic Clinic and Midwest Orthopedics Group, in addition to a hack of as of yet unnamed health insurer. In total, the records of over 9.5 million patients are understood to have been obtained by the hacker.

According to a breach notice issued by POC, the stolen data include names, addresses and other contact information, internal ID numbers, billing amounts, appointment dates, and diagnostic codes. Some patients also had their Social Security number, date of birth, procedure photographs, health insurer’s names, and other identification information stolen.

An external security firm was brought in to conduct a system analysis and to ensure POC’s systems were secured to prevent future attacks. The services of that company have been retained and additional security measures have now been employed, including a new system to monitor for future intrusions.

Please see the HIPAA Journal Privacy Policy

The hacking incident has been reported to the FBI and an investigation into the hacking incident, and the others performed by TheDarkOverlord, is ongoing.

Patients affected by this breach face a high risk of data being used inappropriately. Some of the stolen records were published on Pastebin and the data have been put up for sale on the underground marketplace TheRealDeal.

Patients affected by the breach have now been notified of the incident by mail and have been offered a year of credit monitoring and identity theft protection services to mitigate risk.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.