New Jersey Dermatology Practice Suffers 380,000-Record Data Breach
Morristown, NJ-based Affiliated Dermatologists & Dermatologic Surgeons (ADDS) has announced a major breach of patient data. On March 5, 2024, ADDS found a ransom note on its network that claimed its network had been breached and data had been stolen. ADDS notified its third-party IT provider and brought in cybersecurity specialists to investigate and verify the threat actor’s claims and determined that there had been unauthorized access to the network between March 2, 2024, and March 5, 2024. Evidence was also found confirming files had been copied from its network.
A review was conducted to determine the extent of the breach and on April 10, 2024, it was confirmed that the threat actor had access to the personal information of patients and employees. The breach has recently been reported to the HHS’ Office for Rights as involving the protected health information of up to 380,000 patients. The types of information involved varied from individual to individual. Patient information potentially compromised in the attack includes names, mailing addresses, birth dates, Social Security numbers, medical treatment information, and health insurance claims information. Compromised employee information includes names, mailing addresses, birth dates, Social Security numbers, driver’s license numbers, and passport numbers.
The affected individuals are now being notified by mail and the notification letters state the exact types of information that were compromised for each individual. Many healthcare organizations only provide complimentary credit monitoring and identity theft protection services to individuals whose Social Security numbers and/or financial information are compromised; however, ADDS has offered those services to all affected individuals. ADDS said that at the time of issuing notification letters, it was not aware of any misuse of the compromised data.
ADDS said it has taken several steps to improve security to prevent similar incidents in the future, including password resets for all accounts on the network and implementing multi-factor authentication for all remote access and 24-7 network security monitoring.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
