Potential Data Theft Incident Reported by Austin Manual Therapy
1,750 patients of Austin Manual Therapy (AMT) have been notified that some of their protected health information may have been accessed and stolen by a criminal attacker who gained access to AMT’s computer system.
A forensic investigation by a leading national cybersecurity team revealed access was first gained on October 3, 2017 and continued until October 9, when the intrusion was detected and blocked. According to the breach notice posted on the AMT website, access was not gained to the company’s electronic medical record system. Only a limited portion of the network was accessed – one computer and a shared file system.
While the forensic investigation confirmed that access to some files had been gained, it was not clear how much information was viewed and which, if any, documents had been stolen. An analysis of the file system and computer showed that the following information could have been accessed: Names, addresses, dates of birth, phone numbers, dates of service, charge amounts, occupations, insurance coverage and policy information, health screening information, diagnoses, driver’s license information, referring physician information, and partial and full Social Security numbers.
The breach investigation has largely been completed, although TMD said it is continuing to actively work with forensic investigators and that the investigation will likely continue until the end of the year.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Additional security measures have now been implemented to prevent this type of attack from occurring in the future. While the exact nature of the attack was not detailed in the TMD breach report, Databreaches.net has reported that this was an extortion attempt by the hacking group TheDarkOverlord.
Individuals impacted by the breach have been advised that they can obtain free credit reports and place a fraud alert and security freeze on their accounts, but it would not appear that credit monitoring or identity theft protection services have been offered.
