Patient Information Exposed Through Walgreens Covid-19 Test Registration System
The personal records of persons who got a COVID-19 test at a Walgreens pharmacy were exposed on the web as a result of vulnerabilities found in its COVID-19 test registration program. It is at this time not clear how many people were affected, though they might well be in the millions given the number of COVID-19 tests Walgreens has done starting from April 2020. It is unknown when the website had the vulnerabilities, however, they go...
DuPage Medical Group Faces Lawsuit for July 2021 Ransomware Attack
Two DuPage Medical Group patients are filing a lawsuit against the healthcare company subsequent to a July 2021 ransomware attack whereby patients’ protected health information (PHI) was exposed. DuPage Medical Group encountered a ransomware attack in the middle of July. The forensic investigation confirmed unauthorized people had acquired access to its computer system between July 12 and July 13, and used ransomware to try to extort...
NCCoE Publishes Final Cybersecurity Practice Guide on Mobile Application Solo Sign-On for First Responders
The National Cybersecurity Center of Excellence (NCCoE) at the National Institute of Standards and Technology (NIST) just published the latest edition of the NIST Cybersecurity Practice Guide SP 1800-13, Mobile Application Single Sign-On: Improving Authentication for Public Safety First Responders. Public safety and first responder (PSFR) staff need on-demand access to public safety information to be able to give appropriate...
Unauthorized Individuals Accessed CareATC Email Accounts
Population health management firm CareATC based in Tulsa, OK, has learned that unauthorized people have accessed the email accounts of two workers and possibly acquired access to the personal data of patients and workers. CareATC started an investigation on June 29, 2021 upon detecting suspicious activity in the email account of a worker. Third-party forensics professionals assisted with the breach investigation to find out the...
SonicWall Threat Report Indicates Substantial Growth in Ransomware Attacks
SonicWall publicized a Cyber Threat Report update last July, which affirmed a significant rise in cyberattacks beginning 2020. From January to June of 2021, cryptojacking attacks went up by 23%, encrypted threats went up by 26%, IoT attacks increased by 59%, and ransomware attackers went up by 151% in comparison to the identical time period last year. Ransomware attacks were progressively rising starting Q1 of 2020, nevertheless, the...
Contact Tracing Survey Data of 750,000 Hoosiers Disclosed On the Web
The personal information of 750,000 Hoosiers compiled during a COVID-19 contact tracing survey done by the Indiana Department of Health was compromised on the web and downloaded by a firm not approved to gain access to the data. The survey contained details for instance names, birth dates, emails, addresses and data on gender, race, and ethnicity. The Indiana Department of Health was advised regarding the unauthorized information...
UNM Health Data Breach Impacts Over 637,000 Individuals
UNM Health found out that an unauthorized third party acquired access to its system and possibly viewed and copied files from that included patients’ protected health information (PHI). The healthcare provider discovered the security incident on June 4, 2021 and immediately launched an investigation to determine the extent of the breach. UNM Health confirmed that the unauthorized third party accessed its systems on May 2, 2021 along...
Insider Breach Affects Long Island Jewish Forest Hills Hospital Patients
Long Island Jewish Forest Hills Hospital (LIJFH) has begun informing a number of patients regarding an insider data breach that affected their health records. LIJFH mentioned in its breach notification letters that it discovered an unauthorized medical record access occurrence approximately January 24, 2020. LIJFH received a subpoena for records associated with an investigation by law enforcement into a “No-Fault” motor vehicle...
Phishing Attacks at Academic HealthPlans and Wayne County Hospital
Academic HealthPlans, Inc. (AHP) learned that an unauthorized person has obtained access to the email accounts of two workers after they responded to phishing emails. AHP was informed of a potential breach upon detecting suspicious activity in its Microsoft Office 365 email account. The impacted accounts were made secure, and an investigation was started to find out the scope of the data breach. On June 4, 2021, AHP confirmed that the...
Record GDPR Penalty of $886 Million Issued to Amazon
The Data Protection Authority of Luxembourg, Commission Nationale pour la Protection des Données (CNPD), has penalized Amazon.com with €746 million ($886 million) to settle its EU General Data Protection Regulation (GDPR) violations. Since May 25, 2018, the GDPR has been in effect giving EU citizens legal rights regarding their personal data and put limitations on entities and companies conducting business with EU citizens with...
Florida Heart Associates Serving at 50% Capacity for 2 Months Since a Ransomware Attack
Florida Heart Associates based in Fort Myers, FL encountered a ransomware attack on May 19, 2021 and has brought about significant and ongoing interruption to its services. Medical practice is just running at about 50% capacity for two months since the attack. Interruption is likely to proceed for various more weeks, as it’s not possible for the practice to completely recover until the end of August or the beginning of...
CaptureRx Confronting Multiple Class Action Lawsuits Due to the Ransomware Attack Impacting 2.4 Million Patients
CaptureRx, the healthcare administrative services provider is dealing with multiple class-action lawsuits for its failure to safeguard patient records, which was gotten by unauthorized people in a February 2021 ransomware attack. NEC Networks, also known as CaptureRx, offers IT assistance to hospitals to help them take care of their 340B drug discount packages. By means of providing those offerings, CaptureRx gets the protected health...
Impact of Elekta Ransomware Attack on Advocate Aurora Health, Jefferson Health, and Intermountain Healthcare Confirmed
Three more healthcare providers reported that they were affected by the latest ransomware attack on Elekta Inc, the Swedish radiation therapy and radiosurgery provider. Elekta offers a web-based mobile software referred to as SmartClinic, which healthcare companies utilize to gain access to patient data for cancer treatments. Cybercriminals obtained access to Elekta’s systems from April 2, 2021 to April 20, 2021 copied the SmartClinic...
Kaseya Security Update Resolves Vulnerabilities Exploited in KSA Ransomware Attack
Kaseya has reported a security update published for the Kaseya KSA remote management and tracking software program to resolve the zero-day vulnerabilities, which the REvil ransomware gang fairly recently exploited in attacks on its customers and their clients. The vulnerabilities taken advantage of in the attack were included in a group of seven flaws that the Dutch Institute for Vulnerability Disclosure (DIVD) reported to Kaseya in...
Healthcare Employees Took Legal Action Against Amazon Alleging Alexa Devices Violated HIPAA
Four healthcare employees filed a lawsuit against Amazon because allegedly their Amazon Alexa devices possibly captured conversations without their intention or permission and might have caught health data protected by HIPAA. Amazon Alexa devices listen for words and phrases that awaken the devices and activates them to begin recording. Particularly, the devices listen to the term “Alexa,” and subsequently try to respond to a question...
Exploit Available for ‘PrintNightmare’ Zero-Day Windows Print Spooler RCE Vulnerability
The Cybersecurity and Infrastructure Security Agency (CISA) has given a notification after a proof of concept (PoC) exploit had been published for a zero-day vulnerability identified in the Windows Print Spooler service. The vulnerability was called PrintNightmare and is monitored as CVE-2021-34527. The vulnerability is caused by the Windows Print Spooler service that incorrectly executes privileged file operations. Microsoft claims...
Bill Requiring the Texas State AG to Publish Data Breach ‘Wall of Shame’ Gets Approval
The Texas Legislature followed what California and Maine had done in approving a bill requiring the Texas Attorney General to publish notices regarding personal data breaches that affect state residents on the public-facing web portal of the state Attorney General. The amendment of the Texas Business and Commerce Code § 521.053, now known as House Bill 3746, got a unanimous approval. The bill requires the Texas Attorney General to...
UofL Health and Jawonio Report Email Data Breaches
UofL Health has begun informing 42,465 patients regarding the sending of some of their protected health information (PHI) to the wrong external email address. The healthcare system in Louisville, KY sent breach notification letters to impacted patients on June 7, 2021 instructing them concerning the compromise of some of their PHI. The owner of the external domain contacted UofL Health the next day and gave technical proof showing...
Bipartisan Group of Senators Present Federal Data Breach Notification Bill
A bipartisan group of senators has presented a federal data breach notification law- the Cyber Incident Notification Act of 2021 – that calls for all federal institutions, contractors, and companies that have command over critical infrastructure to report considerable cyber threats to the Cybersecurity and Infrastructure Security Agency (CISA) in 24 hours of knowing about it. Senators Mark Warner (D-VA), Marco Rubio (R-FL), and...
Data Breaches at Arizona Asthma and Allergy Institute, Stillwater Medical Center and Nebraska Department of Health and Human Services
Arizona Asthma and Allergy Institute sent breach notification letters to 70,372 patients who obtained services between October 1, 2015 and June 15, 2020. As per the breach notice, a selection of their personal data and protected health information (PHI) such as names, patient ID numbers, healthcare provider names, health insurance data, and treatment cost details were exposed on the internet under the name of another organization for...
HSCC Requests Biden to Give Financing to Strengthen Cybersecurity Posture of the Medical Industry
The Healthcare and Public Health Sector Coordinating Council (HSCC) has prompted President Biden to give more funds and support to strengthen the cybersecurity posture of the medical care industry to boost toughness against cyberattacks. In the latest letter given to President Biden and replicated to Senate and House party leaders, the HSCC requested additional money to support the healthcare market take care of cyber threats, make...
Social Media and HIPAA Compliance
Social media platforms including Facebook, Snapchat, Twitter, and Instagram allow healthcare companies to easily promote their services and earn new clients. Healthcare companies could utilize social media platforms to connect with patients, give announcements about their services, and get patients to take on a more dynamic part in their medical care. Although there are a lot of advantages that may result from using social media in...
Third-Party Phishing Attack Impacts Around 34,862 Lafourche Medical Group Patients
Urgent care center operator Lafourche Medical Group located in Louisiana has informed 34,862 patients regarding a security breach that likely impacted their protected health information (PHI). Lafourche Medical Group discovered on March 30, 2021 that a third-party accountant had clicked a phishing email that imitated one of the business owners of Lafourche Medical Group and shared account information with the threat actor. The exposed...
Healthcare Organizations Dealing with Higher Cyber Insurance Costs for Less Coverage
The number of cyberattacks currently being reported is greater than ever before. A few years ago, healthcare cyberattack reports are received at a rate of one each day, however, in 2021, there have been months where cyberattacks were reported at double that rate. The seriousness of cyberattacks has likewise become more intense and the cost of dealing with and recovering from attacks is right now much greater. The probability of a...
420,433 People Affected by Health Plan of San Joaquin Email Security Breach
Health Plan of San Joaquin (HPSJ), which is a not-for-profit service provider of Medi-Cal managed care based in French Camp, CA, learned that an unauthorized individual has obtained access to its email system and likely viewed or obtained sensitive data. HPSJ noticed a likely email breach on or approximately October 12, 2020 after identifying suspicious activity in its email system. The health plan provider affirmed on October 23,...
Is it a HIPAA Violation to Require Confirmation of Vaccine Status?
There is a lot of misunderstandings concerning the case of questioning a person if they had a COVID-19 vaccine. Is it considered a HIPAA violation, especially pertaining to employers questioning their personnel to give evidence of being vaccinated against COVID-19 to cease using a face mask in the work area? The Health Insurance Portability and Accountability Act (HIPAA) contains terms relevant to personal privacy and uses and...
Ransomware Gangs Use New Triple Extortion Tactics
After the DarkSide ransomware attack on Colonial Pipeline, a number of ransomware gangs have stopped activity or have executed guidelines that their affiliates are required to follow, which include stopping all attacks on critical infrastructure companies, medical care companies, and government institutions. A few well-known hacking forums are separating themselves from ransomware and have prohibited ransomware gangs from promoting...
President Biden Signs Expansive Executive Order to Enhance Federal Networks Cybersecurity
On May 13, 2021, President Biden signed a comprehensive Executive Order that seeks to appreciably strengthen cybersecurity protections for federal systems, enhance threat information sharing between the private sector, the government, and law enforcement, and present a cyber threat response playbook to speed up the response to incidents and their mitigation. The 34-page Executive Order consists of short time spans for executing...
PHI Compromised Because of the University of Florida Health Shands, St. John’s Well Child and Family Center and St. Paul’s PACE Breaches
University of Florida Health Shands has learned that an ex-employee has viewed the health files of 1,562 patients without valid permission. The HIPAA violations were uncovered on April 7, 2021. The provider promptly ended the worker’s access to medical documents pending an investigation. The investigation established that the worker had been accessing patient health records without authorization between March 30, 2019 and April...
NIST Wants Feedback on Designed Updates to HIPAA Security Rule Implementation Guidance
The National Institute of Standards and Technology (NIST) is preparing to modify and make updates to its guidance on carrying out the HIPAA Security Regulation and is looking for ideas from stakeholders on facets of the guidance that ought to be adjusted. NIST publicized the guidance – NIST Special Publication (SP) 800-66, Revision 1, An Introductory Resource Guide for Implementing the Health Insurance Portability and...
Three Actively Exploited Zero-Day Vulnerabilities in SonicWall Email Security
Three zero-day vulnerabilities were found in SonicWall Email Security solutions are being actively exploited in the wild by one or more threat actors. The vulnerabilities may be chained to obtain admin access to enterprise systems and do code execution. SonicWall Email Security products are used as a physical machine, virtual appliance, as a hosted SaaS solution or software installation, and offer security from phishing, spear...
Higher Ransom Payment Due to Accellion FTA Data Exfiltration Extortion Attacks
The latest Coveware Quarterly Ransomware Report states that the growth in ransomware attacks in 2020 has persisted in 2021 as most threat actors target the healthcare industry. 11.6% of all attacks in quarter 1 of 2021 were healthcare ransomware attacks, the same with the public sector attacks. Attacks on professional services companies accounted for 24.9% of all attacks. Although ransom demands dropped in Q4 of 2020, that pattern...
Data Breaches Reported by the American College of Emergency Physicians, Epilepsy Florida and VEP Healthcare
The American College of Emergency Physicians (ACEP) has commenced notifying some of its members regarding the unauthorized access of their personal data that was located on a server. Besides offering professional company services to its members, ACEP offers management services to companies such as Society for Emergency Medicine Physician Assistants (SEMPA), the Emergency Medicine Residents’ Association (EMRA), and the Emergency...
Montefiore Medical Center Staff Laid Off and Belden Class Action Lawsuit
Montefiore Medical Center has found out that another employee accessed patient records without having any valid work reason. The report of New York hospital in February 2020 stated that an employee was identified to have accessed patient health records without any authorization for a period of 5 months in 2020, and another employee was identified to have obtained the protected health information (PHI) of around 4,000 patients between...
Hackers Stole the PHI of Over 200,000 Washington D.C. Health Plan Members
CareFirst BlueCross BlueShield Community Health Plan District of Columbia (CHPDC) is notifying its members with regards to a cyberattack that resulted in the theft of their protected health information (PHI). CHPDC, previously known as Trusted Health Plans, discovered a breach of its computer networks on January 28, 2021. The health plan based in Washington D.C took fast action to separate the impacted computers and safeguarded its...
What is Texas HB 300?
What is Texas HB 300, who needs to follow the legislation, and what are the fees and penalties for failing to comply? This post talks about these and other vital questions regarding Texas HB 300. What is Texas HB 300? The Health Insurance Portability and Accountability Act (HIPAA) is federal legislation that requires healthcare companies, health plans, and health care clearing house to comply with minimum privacy and security...
Over 1.2 Million Health Net Members Impacted by Cyberattack on Accellion
A number of healthcare companies have lately affirmed they were impacted by the Accellion cyberattack last December 2020. The attack was connected to the Clop ransomware gang since its leak website had published parts of the stolen data from the attack, though it seems that no ransomware was used. Accellion used a file transfer solution for sending files that were too large to be transmitted through email. Health Net was the platform...
Data Breaches at Mobile Anesthesiologists Patients, Haven Behavioral Healthcare and Heart of Texas Community Health Center
Mobile Anesthesiologists fairly recently found out about the exposure of a limited amount of patients’ protected health information (PHI) because of a technical misconfiguration. The problem seemed to have occurred prior to December 14, 2020, and allowed public access of PHI like names, health insurance details, date of service, medical procedure, and dates of birth. An investigation of the issue concluded on January 28, 2021 and it...
UPMC and Charles Hilton and Associates Charged With Class Action Lawsuit Due to 36,000-Record Breach
University of Pittsburgh Medical Center (UPMC) and the law agency Charles Hilton and Associates are dealing with a class-action lawsuit because of a breach of the protected health information (PHI) of 36,000 UPMC patients. Charles Hilton and Associates, which manages UPMC’s collections, reported that attackers had acquired access to the email accounts of a number of its staff from April to June 2020. As per the investigation...
Data Breaches at California Department of State Hospitals and Eyemart Express
The Department of State Hospitals (DSH) in California has learned a worker obtained access to the protected health information (PHI) of 1,415 present/former patients and 617 personnel without consent. The employee had an Information Technology job and got access to data servers that contain sensitive patient and staff information so as to perform work assignments. DSH found out about the inappropriate access on February 25, 2021 while...
Data Breaches at New London Hospital, Child Focus and Orlando Health South Lake Hospital
New London Hospital based in central New Hampshire has identified an unauthorized person who accessed a file on its system in July 2020 and may have gotten the protected health information (PHI) of 34,878 patients. A third-party cybersecurity agency helped investigate the incident and confirmed on February 16, 2021 that the person accessed the file for a little while and might have duplicated it. The file included patient names,...
Phishing Attack on Saint Alphonsus Health System, Saint Agnes Medical Center and Southeastern Minnesota Center for Independent Living
Due to a phishing attack encountered by Saint Alphonsus Health System based in Boise, ID, the information of its patients was potentially compromised, including the data of patients of Saint Agnes Medical Center located in Fresno, CA. Saint Alphonsus detected strange activity in the email account of an employee on January 6, 2021. The provider immediately secured the email account and investigated the incident to determine the source...
Virginia Consumer Data Protection Act Approved
Governor Ralph Northam has approved the Virginia Consumer Data Protection Act (CDPA). CDPA necessitates individuals running a business in the Commonwealth of Virginia to abide by new data privacy and security conditions. The CDPA will be effective on January 1, 2023. The CDPA has similarities with a number of the privacy and security conditions of the EUs General Data Protection Regulation (GDPR) that was enforced on March 25, 2018,...
PHI Exposed as a Result of Data Breaches at Pennsylvania Adult & Teen Challenge And Gore Medical Management
Pennsylvania Adult & Teen Challenge located in Rehrersburg, PA announced that an unauthorized individual obtained access to worker email accounts that included the PHI of 7,771 people. This provider operates addiction treatment programs for adults and youngsters. On July 29, 2020, the provider noticed suspicious things in an email account and had taken action to avert continued access and inspect the incident. The investigation...
Online Storage Vendor Pays Ransom to Retrieve Healthcare Data Stolen During Cyberattack
The protected health information (PHI) of 29,982 patients of Harvard Eye Associates located in Laguna Hills, CA was potentially stolen due to a cyberattack on its cloud storage provider. The medical and surgical eye care services provider received notification on January 15, 2021 that cyber attackers acquired access to the computer network of its storage vendor and exfiltrated data. It’s not sure if the attackers had encrypted...
100% of Screened mHealth Applications Prone to API Attacks
The personally identifiable health information of a huge number of people is being compromised by means of the Application Programming Interfaces (APIs) employed by mobile health (mHealth) apps, reported by a current study shared by cybersecurity agency Approov. Ethical hacker and researcher Allissa Knight carried out the study to discover how protected famous mHealth apps are and if it’s possible to acquire access to users’...
$75,000 Paid by Renown Health to Settle its HIPAA Right of Access Case
The Department of Health and Human Services’ Office for Civil Rights (OCR) is moving forward with its campaign to stop noncompliance with the HIPAA Right of Access. OCR reported its fifteenth settlement this week that resolved a HIPAA Right of Access enforcement action. Renown Health, a Northern Nevada non-profit healthcare network, agreed to pay a financial penalty of $75,000 for its HIPAA case with OCR in order to take care of its...
Ransomware Attacks on Ramsey County and Crisp Regional Health Services and Vulnerability in Vaccine Scheduling Application
The County Manager’s Office of Ramsey County, MN has begun informing 8,700 customers of its Family Health Division regarding the potential access of some of their personal data by unauthorized persons brought about by a ransomware attack on its vendor Netgain Technology LLC. Netgain Technology LLC based in St. Cloud offers technology solutions to Ramsey County, such as an application utilized by the Family Health Division for...
Brandywine Urology Consultants Data Breach Lawsuit Dismissed Because of Lacking Evidence of Harm
The Delaware Superior Court dismissed a legal action filed on behalf of affected individuals of a Brandywine Urology Consultants data breach because the plaintiffs failed to present proof showing they had experienced harm because of the breach. Brandywine Urology Consultants encountered a ransomware attack on January 27, 2020 The attack was identified after two days and the succeeding investigation affirmed the attackers got access to...
Philadelphia Department of Public Health Ends Vaccine Distribution Agreement Due to Alleged Privacy Breaches
The contract of Philly Fighting COVID to dispense COVID-19 vaccines in Philadelphia city with the Philadelphia Department of Public Health was terminated because of allegations that the company’s privacy policies possibly made possible the sale of private information to third parties. Philly Fighting COVID started out as a nonprofit company providing coronavirus screening and then switched to supplying COVID-19 vaccinations. The...