Leading US healthcare solutions provider Henry Schein said the data breach it suffered in October compromised the sensitive personal information of almost 30,000 individuals.

In a security incident notice posted on its website, Henry Schein said it identified a cyber security incident on October 14 that affected portions of its manufacturing and distribution businesses.

The healthcare solutions provider said it immediately launched an investigation with assistance from third party cyber security experts to understand the nature and scope of the incident. It also took precautionary action, including taking parts of its internal network offline to limit the spread of the malware, which led to temporary disruption of some business operations.

On November 13, the company sent out notices to both customers and suppliers to share the details of an investigation it conducted following the cyber security incident.

In a filing with the Office of the Attorney General of Maine, Henry Schein said that servers that contained the sensitive personal information of its employees were accessed by the threat actors.

The compromised data included names, addresses, phone numbers, email addresses, photographs, dates of birth, demographic and background information, government-issued identification numbers including Social Security numbers, driver’s license and state identification numbers, passport numbers, financial information including bank account information, credit card numbers, loan details, medical history, treatment, and insurance information, details of employment at the company, IP address, and more.

The filing with the regulator also revealed that at least 29,112 individuals have been impacted by the data security incident.

“Please be assured that we are doing everything we can to address the incident. Upon discovery of the incident, our cybersecurity team immediately took a series of steps, including taking certain systems offline and other steps intended to contain the incident, hiring cybersecurity experts, conducting an investigation to identify and remove any malicious files and determine company systems that were impacted, and seeking to implement measures to fortify our defences going forward,” the company said in its notice.

Henry Schein has urged all its employees to remain vigilant and monitor their credit reports and financial statements for any suspicious activities and to report suspicious activities to relevant law enforcement authorities and their banks. The company is also providing two years of complimentary credit monitoring and identity theft protection services via Experian IdentityWorks to all affected individuals whose data was compromised during the incident.

The notorious BlackCat/ALPHV ransomware group claimed responsibility for launching the cyber attack on the healthcare provider’ systems and listed the company as a victim on its data leak site. The group claimed to be in possession of around 35 terabytes of stolen data and gave Henry Schein until November 3 to pay a ransom.

According to a screenshot shared by cybersecurity analyst and security researcher Dominic Alvieri, on December 5, the BlackCat/ALPHV ransomware group launched a second ransomware attack and re-encrypted the company’s servers.

“Many of you recognise the name Henry Schein from recent weeks’ posts and media outlets. As you know, Henry was restored and back in operation after one month of silence, until now,” the group posted.

“Aon’s partner Stroz Friedberg and AVASEK teams thought they were doing a good job for HENRY, but they were just preparing for Henry’s next catastrophe.

“WE HAVE RE-ENCRYPTED HENRY SCHEIN TWICE AND THIRD COMING SOON,” it added.