Ransomware Gangs Hit Debt Collection Firm and Mental Healthcare Provider
Ransomware attacks have been announced by Financial Asset Management Systems and The Harris Center for Mental Health. Munsen Healthcare is investigating a cyberattack on Munsen Healthcare Otsego Hospital, and St. Bernards Healthcare has confirmed that patient information was compromised in a MOVEit Transfer hack.
The Harris Center for Mental Health and IDD Recovering from a Ransomware Attack
The Harris Center for Mental Health and IDD in Texas has recently fallen victim to a ransomware attack. The incident was detected on November 7, 2023, when staff members were prevented from accessing files. The network was immediately shut down to limit the harm caused, and cybersecurity consultants were engaged to assist with the recovery and investigation.
The Harris Center for Mental Health said it is continuing to provide care to patients; however, the lack of access to electronic systems has inevitably led to delays. The forensic investigation has confirmed that there was unauthorized access to its network between November 6 and November 7, 2023, and there was unauthorized access to files containing patient data.
Those files contained the protected health information of 238,463 individuals, including names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, U.S. Alien Registration numbers, driver’s license/state ID numbers, financial account information, treatment/diagnosis information, prescription information, provider names, medical record/case numbers, Medicare/Medicaid ID numbers, health insurance information, and treatment costs. The types of information that were compromised varied from individual to individual. The Harris Center for Mental Health and IDD said the affected individuals have now been notified and complimentary credit monitoring and identity protection services have been offered to the affected individuals.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
This is the second major incident to affect The Harris Center for Mental Health this year. A service provider used the MOVEit Transfer tool, a vulnerability in which was exploited to provide unauthorized access to sensitive data in May 2023. The protected health information of 599,367 individuals was stolen in the attack.
Ransomware Attack on Financial Asset Management Systems Affects 165,000 Patients
Financial Asset Management Systems (FAMS), a business management consultancy and debt collection firm, has recently reported a HIPAA data breach to the HHS’ Office for Civil Rights that has affected 164,796 patients. In its substitute breach notice, FAMS said it experienced a “network disruption” incident, which prevented access to certain files on its network. The forensic investigation and review of the exposed files was completed on August 31, 2023, and confirmed that the exposed information included names, billing account numbers, costs paid, balances due, and the name of the affected FAMS client. The affected individuals started to be notified on October 20, 2023, and credit monitoring and identity theft protection services have been offered to the affected individuals.
Munsen Healthcare Otsego Hospital Investigating Cyberattack
Munsen Healthcare has confirmed that it is investigating a cyberattack on Munsen Healthcare Otsego Hospital in Gaylord, MI. Munsen Healthcare said computer systems were shut down in response to the security incident and a third-party cybersecurity company has been engaged to conduct a forensic investigation to determine the nature and scope of the attack.
Details about the nature of the attack, such as if this was a ransomware/extortion incident, have not been publicly disclosed, and it has yet to be determined if patient data has been exposed or obtained.
Business Associate Data Breach Affects 89,500 St. Bernards Healthcare Patients
Jonesboro, AR-based St. Bernards Healthcare, Inc., a health system serving northeast Arkansas and southeast Missouri, has recently announced that the protected health information of 89,556 patients has been exposed in a data breach at one of its third-party vendors.
St. Bernards Healthcare contracted with Welltok Inc. to provide an online contact management platform. The platform was used to communicate important notices and communications through its subsidiary, Tea Leaves Health LLC. Welltok used Progress Software’s MOVEit Transfer product, a zero-day vulnerability in which was patched on May 31, 2023; however, the vulnerability had already been exploited on May 30. Welltok discovered it had been affected by the mass exploitation of the vulnerability on July 26, 2023, and its investigation revealed on August 11, 2023, that sensitive data was exfiltrated in the attack.
St. Bernards Healthcare was notified about the breach by Welltok on September 14, 2023, and was told about the full scope of the breach on October 18, 2023. The information stolen in the attack included names, addresses, dates of birth, email addresses, phone numbers, Social Security numbers, patient identification numbers, health insurance information, providers’ names, and medical treatment/diagnosis information. Welltok started to notify the affected individuals on November 13, 2023.
