PHI of More Than 420,000 Individuals Potentially Compromised in Ransomware Attack on Ohio Law Firm
Bricker & Eckler, one of the leading law firms in Ohio, suffered a ransomware attack in January in which client information was potentially compromised. The ransomware infection was detected by the law firm on January 31, 2021 and a third-party cybersecurity firm was engaged to assist with the investigation.
The investigation revealed the attackers first gained access to its systems on January 14, 2021, and access remained possible until January 31, 2021. During that time the attackers gained access to files containing client information and exfiltrated some data from the law firm’s systems.
A notice about the security incident on the law firm’s website confirms that the attackers were contacted, and information stolen in the attack was retrieved, suggesting the ransom was paid. Bricker & Eckler said the attackers confirmed they took steps to delete the stolen data and reassurances were provided that there had been no further disclosures of the stolen information and that no copies of the data had been retained.
As a full-service law firm serving clients in the healthcare industry, it was necessary for clients to provide the law firm with certain protected health information as part of the client engagement. That information was used as part of the legal services provided. It is possible that some of that information may have been viewed or obtained in the attack.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Bricker & Eckler said the protected health information potentially compromised included names and addresses and, for certain individuals, medical information and/or education-related information, driver’s license numbers and/or Social Security numbers.
The law firm started sending notification letters to all affected individuals on April 6, 2021. The law firm has taken steps to enhance the security of its network, internal systems, and applications to prevent similar attacks in the future.
The breach has been reported to the HHS’ Office for Civil Rights as affecting up to 420,532 individuals.
