Hacker Steals PHI of 23,000 Patients of Prosthetic and Orthotic Care
Prosthetic and Orthotic Care (POC), an independent prosthetics and orthotics company serving disabled individuals in Southern Illinois and Eastern Missouri, has discovered that an unauthorized individual has stolen the protected health information of 23,015 patients.
The cyberattack occurred in June 2016, although POC only became aware of the hacking incident on July 10. The hacker gained access to patient data by exploiting security flaw in a third party software system that had been purchased by POC. The attack was conducted by a hacker operating under the name – TheDarkOverlord – who was also responsible for the cyberattacks on Athens Orthopedic Clinic and Midwest Orthopedics Group, in addition to a hack of as of yet unnamed health insurer. In total, the records of over 9.5 million patients are understood to have been obtained by the hacker.
According to a breach notice issued by POC, the stolen data include names, addresses and other contact information, internal ID numbers, billing amounts, appointment dates, and diagnostic codes. Some patients also had their Social Security number, date of birth, procedure photographs, health insurer’s names, and other identification information stolen.
An external security firm was brought in to conduct a system analysis and to ensure POC’s systems were secured to prevent future attacks. The services of that company have been retained and additional security measures have now been employed, including a new system to monitor for future intrusions.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The hacking incident has been reported to the FBI and an investigation into the hacking incident, and the others performed by TheDarkOverlord, is ongoing.
Patients affected by this breach face a high risk of data being used inappropriately. Some of the stolen records were published on Pastebin and the data have been put up for sale on the underground marketplace TheRealDeal.
Patients affected by the breach have now been notified of the incident by mail and have been offered a year of credit monitoring and identity theft protection services to mitigate risk.
