Assailants Attack Illinois Medical Center; 147k Patient Records Stolen

Southern Illinois Healthcare oversees the operations of Harrisburg Medical Center (HMC), a not-for-profit community hospital with over 70 beds and 140 physicians. They are partnered with other clinics in the area, providing a comprehensive healthcare network for residents in the region. HMC suffered a network data breach nearly a year ago.

How Did the Attack Occur? 

According to the Notice of Data Incident published on HMC’s website, an unauthorized third party accessed the center’s internal network. HMC officials described the event as causing suspicious activity, although there are no other details about the attack’s symptoms. The lack of additional details from the incident is unfortunate; it leaves the public to speculate about how the assailants caused the event. The public’s trust may waiver without information about how the attackers committed the attack. If an injection or malware caused the attack, the event’s fault may fall outside HMC’s responsibilities; however, if the attack came from an employee or system vulnerability, the event may have occurred directly because of HMC. 

What Information Was Viewed or Stolen? 

The majority of compromised data in this event belongs to HMC patients. When the attackers breached their network, they accessed documents listing some personal information belonging to specific individuals. The exposed information includes patient names, birthdays, Social Security Numbers, clinical details like diagnosis/treatments, lab results and prescription information, health insurance information, driver’s license numbers, electronic signatures, and some financial account numbers. 

How Did Harrisburg Medical Center Admit to the Breach? 

HMC’s breach happened nearly a year ago. According to the published notices, the unauthorized actor accessed the healthcare network between December 19th, 2022, and December 23rd, 2022. On or around December 23rd, 2022, officials discovered suspicious activity and immediately moved to secure their network. Their initial review concluded around February 21st, 2023, with further reviews finishing around mid-August. Since then, HMC has worked to notify those with exposed information and the authorities. This week, on December 12th, 2023, physical notices were mailed to those whom HMC had valid addresses. 

What Will Become of the Stolen Information? 

The breach filing published on the Maine Attorney General’s website states an impact figure of 147,826 people. A breach of this size is concerning, not only because of its significant impacts on the victims but also because of the nearly year-long lapse of notification. In the last year, the assailants could have misused or sold the patient information, putting patients at risk. Patients are at risk for financial, identity, and medical fraud. The bad actors could even impersonate them, putting them at risk for criminal charges and physical danger. 

What Should Affected Parties Do in the Aftermath of the Breach? 

The exposed data could have traveled to anyone online in the year since the breach. The assailants could have sold it on a dark forum or used it to gain details about other sensitive systems; it may have ended up in the hands of a cybercriminal gang waiting to launch wire fraud transactions. The only thing victims of this breach can do is take preventative cautions. 

Actions like changing passwords and contact details within applicable accounts, investing in identity monitoring services for suspicious activities, and updating their technology devices with new securities are the minimum actions they should take. Although the event happened a year ago, data owners can still impact how cybercriminals can use their information; they don’t even need to wait for a notice.