Healthcare information technology services provider Datavant group said that the data security incident it suffered last year compromised the sensitive personal information of almost 50,000 individuals.
Headquartered in Phoenix, Arizona, Ciox Health, doing business as Datavant Group, develops and maintains a digital ecosystem for the exchange of healthcare data. Its clients include clinical research organisations, pharmaceutical companies, analytics companies and hospitals operating primarily in the US healthcare market.
In a data security incident notice filed with the Office of the Maine Attorney General, Datavant said that on May 9, the company determined that a limited number of email users were the subject of a phishing email attack. While the incident was contained on the same day, Datavant launched an investigation, with assistance from external cyber security experts, to determine the scope of the incident.
“That investigation concluded on or about August 8, 2024, and determined that an unauthorised individual(s) gained access between May 8, 2024 and May 9, 2024 to certain Datavant data contained in a single user’s mailbox,” reads the notice.
A comprehensive review of the compromised data confirmed that the sensitive personal data of minors were accessed by the threat actors.
The compromised data included names, addresses, contact information, Social Security numbers, financial account information, driver’s licenses, passports, and health information. While Datavant initially reported that about 10,639 individuals were impacted by the incident, it said in a fresh filing with the Maine state regulator that at least 49,454 people were affected by the breach.
Datavant has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general. It has also offered two year of complimentary identity protection and credit monitoring services through Kroll to all affected individuals.
At the time of publishing, no known hacker group has claimed responsibility for the cyber attack on the healthcare technology provider. The company also did not share details on who is behind the attack or if it has paid a ransom.
