St. Louis, Missouri-headquartered Ascension Healthcare said that the ransomware attack it suffered earlier this year compromised the sensitive personal information of almost 5.6 million individuals.
In a data security incident notice posted on its website, Ascension said that on 8th May, it detected unusual activity in portions of its network and quickly launched an investigation, with assistance from cybersecurity company Mandiant, to understand the nature and scope of the incident.
In a separate update, the healthcare systems provider said it suffered a ransomware attack and notified relevant law enforcement and governing agencies, including the FBI, the Cybersecurity and Infrastructure Security Agency (CISA), the Department of Health and Human Services (HHS), and the American Hospital Association (AHA).
“We have also identified how the attacker gained access to our systems. An individual working in one of our facilities accidentally downloaded a malicious file that they thought was legitimate. We have no reason to believe this was anything but an honest mistake,” Ascension said.
In a data security incident notice filed with the Office of Maine Attorney General, Ascension said that it found evidence indicating that on May 7 and 8, a cybercriminal obtained a copy of certain files containing personal information of Ascension patients and employees. The compromised data included names, dates of birth, addresses, Social Security numbers, tax identification numbers, driver’s license numbers, passport numbers, medical information including medical record numbers, dates of service, types of lab tests, and procedure codes, payment information such as credit card information and bank account numbers, insurance information including Medicaid & Medicare IDs, policy numbers, or insurance claim details.
The filing with the Maine state regulator also states that at least 5,599,699 individuals were impacted by the data security incident.
The healthcare service provider has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities. It has also offered two years of complimentary identity protection and credit monitoring services through IDX to all affected individuals.
