Dive Brief:
- Norton Healthcare said sensitive data on 2.5 million people was exposed by a ransomware attack in May, the clinic and hospital group said Friday in a data breach notification filed with Maine’s attorney general.
- Norton Healthcare discovered the cyberattack on May 9, which it later determined was ransomware. The threat actors had access to some network storage devices between May 7 - 9, but the healthcare group’s medical record system was not compromised, the company said in the filing.
- An investigation into the attack, which was completed in mid-November, determined names, contact information, Social Security numbers, dates of birth, health and insurance information, and medical ID numbers were compromised.
Dive Insight:
Ransomware attacks against healthcare organizations are up 278% in the past four years, the Department of Health and Human Services said in late October. “The large breaches reported this year have affected over 88 million individuals, a 60% increase from last year,” the agency said.
Healthcare organizations are widely targeted by ransomware actors because of the sensitive data they hold and the critical services they provide. This makes downtime a potentially life-or-death situation for patients and increases pressure on victims to pay extortion demands.
At least 36 U.S. healthcare systems spanning 130 hospitals have been impacted by ransomware attacks this year, according to Brett Callow, threat analyst at Emsisoft.
Kentucky-based Norton Healthcare operates 8 hospitals and 40 clinics with more than 20,000 employees and 3,000 medical providers, according to its website.
Norton Healthcare said it did not make a ransom payment and has not detected any additional indicators of compromise since it began restoring its systems from backups on May 10.
The delayed disclosure, seven months after the intrusion was detected, underscores the complicated nature of post-incident investigations.
The process of reviewing potentially exfiltrated documents to identify which individuals and types of data were impacted “proved to be time consuming,” Norton Healthcare said.
