Chattanooga Heart Institute Updates on 2023 Network Cyber Attack

Patients with cardiovascular issues may appear in one of the Chattanooga Heart Institute (CHI) facilities in Tennessee and Georgia. The network features a substantial team of surgeons, specialists, and cardiologists. CHI provides a comprehensive approach to cardiac care, offering patients exceptional services when needed. According to the event statement published on CHI’s website, they suffered a cyberattack in mid-March of last year; the attack reportedly impacted the data of 413,236 patients and associates. 

How Did the Attack Occur? 

The Maine Attorney General’s Office published a breach filing in association with the events and CHI’s updates concerning it. In conjunction with the filing, officials also published sample consumer notices about the incident. The most detail offered by the notices concerns CHI reacting to the threat after identifying “indications of a cyberattack,” whether this means officials ran into encryptions and successfully defended the environment against the actor’s attack or they discovered missing files or another sign of a cyberattack, remains unclear. 

What Information Was Viewed or Stolen? 

The CHI website statement does offer a list of potentially impacted details. These exposures may differ between individuals but primarily include names, mailing addresses, email addresses, phone numbers, birthdays, driver’s license numbers, Social Security Numbers, account information, health insurance data, diagnosis and condition details, lab results, medications, demographic data, and some financial information. These compromised elements are significant losses—consequently, victims must act immediately to protect themselves.

How Did Chattanooga Heart Institute Admit to the Breach? 

According to the newest update published with the consumer notices, the assailant accessed CHI’s network environment from March 8th to March 16th, 2023. Presumably, they got away without detection until around a month later—when officials noticed cyberattack indications (around April 17th). In December 2023, investigations further confirmed that the stolen data was from the network’s patients, employees, and employee dependents. Officials have sent notices about the event in waves, with the first happening around July 28th, 2023, then October 6th, and most recently, around February 13th, 2024. 

What Will Become of the Stolen Information? 

The data stolen in this event is significant, not only because it involves personally identifying information but also because it involves medical and financial details. A cybercriminal could misuse personally identifiable information in various ways, from different types of identity theft to impersonation. Otherwise, criminals could misuse financial information to obtain loans, create wire transfer fraud, or steal money directly from their victims. Patient data can be misused to obtain services that the criminals are not entitled to (while potentially putting the victim in physical danger). At the same time, employees might have their accounts breached and further misused by the assailants. No matter what type of data this event may impact, victims must take action to be protected from identity theft. 

What Should Affected Parties Do in the Aftermath of the Breach? 

All personal and work accounts must have unique passwords and usernames, especially when connected to business emails or social media platforms. Those with financial threats may consider closing their accounts and opening new ones; however, those with compromised medical data may find difficulties in achieving a “new slate.” In cases like these, victims should request itemized EoBs from their providers and insurance companies—and consider account monitoring for those profiles that aren’t active daily. Many victims of this breach have already received a physical notice of the event. However, with the investigations continuing, more victims may be announced weeks or months from now; victims shouldn’t wait for their notice to start protecting their data.