PHI of 127,000 NorthCare Patients Potentially Compromised in Ransomware Attack
NorthCare, an Oklahoma City, OK-based mental health clinic, was the victim of a ransomware attack in June 2021, in which patients’ protected health information may have been compromised.
NorthCare identified suspicious network activity on June 1, 2021, when ransomware was used to encrypt files. The investigation into the attack confirmed its network was breached on May 29, 2021. The attackers rapidly deployed ransomware to prevent access to files and demanded payment of a ransom for the keys to decrypt files.
Steps were immediately taken to contain the attack, and while it was not possible to prevent file encryption, it was possible to restore its systems and data from backups without paying the ransom.
The parts of the network accessed by the attackers contained patients’ protected health information. While data exfiltration was not confirmed, NorthCare is assuming the attackers accessed patient data. The types of data potentially compromised in the attack included full names, addresses, dates of birth, medical diagnoses, and Social Security numbers.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Following the attack, third-party forensics experts were engaged to assist with the investigation and remediation efforts, the Federal Bureau of Investigation was notified, and NorthCare has been working with technical experts to improve the security of its systems and limit network access.
Since protected health information was potentially accessed and obtained, NorthCare has offered identity monitoring, fraud consultation, and identity theft restoration services to affected individuals for 12 months at no cost.
The breach notification sent to the Maine attorney general indicates that the protected health information of 127,883 individuals was compromised in the incident. The HHS’ Office for Civil Rights breach portal indicates 128,556 patients were affected.
