Ransom Paid to Recover Healthcare Data Stolen in Cyberattack on Online Storage Vendor
The protected health information of 29,982 patients of a Laguna Hills, CA-based provider of medical and surgical eye care services has potentially been stolen in a cyberattack on its online storage vendor.
On January 15, 2021, Harvard Eye Associates was informed by its storage vendor that hackers had gained access to the vendor’s computer system and exfiltrated data. It is not clear whether files were encrypted to prevent access; however, a ransom demand was issued for the return of the stolen data. The storage vendor consulted with cybersecurity experts and the Federal Bureau of Investigation and took the decision to pay the ransom demand.
The hackers returned the stolen data and provided assurances that no copies of the data had been made and there had been no further disclosures of the stolen information. The cybersecurity experts engaged by the security vendor have been monitoring the Internet and darknet and have not found any evidence to suggest the stolen data has been sold or leaked online. An investigation into the breach revealed the hackers first gained access to its computer systems on October 24, 2020.
The types of patient information potentially obtained by the hackers included patients’ names, addresses, phone numbers, email addresses, dates of birth, medical histories, health insurance information, medications, and information about treatment provided at Harvard Eye Associates.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Harvard Eye Associates provides billing and other administrative services to Alicia Surgery Center in Laguna Hills, which requires access to the types of data previously mentioned. Alicia Surgery Center patients were also affected by the security incident. It is currently unclear how many patients of Alicia Surgery Center have been affected.
Harvard Eye Associates and Alicia Surgery Center explained in their website breach notices that affected individuals are being notified and offered complimentary credit monitoring and identity theft protection services.
