Cybercriminals Target the Heart of Arizona; 484k Records Stolen from Cardiovascular Group

In the Valley of the Sun, Cardiovascular Consultants Ltd. (CVC) provides clinical, surgical, and consultation services; the Phoenix-based cardio group serves 11 of the region’s hospitals—offering a range of assistance for patients and physicians. In September, cybercriminals attacked CVC. The event may have exposed the information of thousands.

How Did the Attack Occur? 

The Data Breach Notice published on the CVC website indicates that an unauthorized party accessed their computer systems. Once inside the system, the bad actor encrypted some information and decisively stole other data. Although the breach notice does not indicate further details, we can infer much about what may have happened. The assailant likely gained access through a vulnerable network gate or by tricking an employee into clicking a link infected by malware. 

Data encryption within the network may indicate that malware was released, which may account for the stolen data. The notice does not state any details about the encrypted data or if their defensive experts were able to unencrypt it. Subsequently, CVC may function with backed-up data, allowing them to avoid ransomware demands altogether. Regardless of the event’s details, the consequences remain—assailants stole the information of thousands.

What Information Was Viewed or Stolen? 

The stolen information purportedly comes from three distinct groups within the CVC systems. The details differ between individuals, but the significant risks created by the exposure of the data present do not. 

Patient information that the bad actors may have exposed in this event includes names, addresses, birthdays, contact and demographic information, emergency contacts, Social Security Numbers (SSNs), insurance policy numbers, guarantor information, medical and billing records, and diagnosis/treatment details. 

The criminals may have also stolen account guarantors’ information, including full names, residential addresses, phone numbers, email addresses, and birthdays. Finally, insurance policyholders may have also had exposures, including names, addresses, phone numbers, dates of birth, insurance policy data, group and policy account numbers, and SSNs. 

How Did Cardiovascular Consultants Ltd. Admit to the Breach? 

The notice states that the attack happened on or sometime before September 27th, 2023; two days later, around September 29th, CVC officials made discovery of the event and notified cyber experts and authorities. Officials launched investigations and presumably concluded at the end of November. Around December 1st, CVC officials notified the Department of Health and Human Services; a day later, they began sending impact notices. 

What Will Become of the Stolen Information? 

How the thieves plan to use the stolen data is uncertain. We have no information about the nuances of the event. Thus, we cannot derive their motives. Subsequently, patients, guarantors, and insurance policyholders should all implement cybersecurity defenses. They can fall victim to fraudulent plots, impersonations, and even physical dangers.

What Should Affected Parties Do in the Aftermath of the Breach? 

Those with relationships to CVC must consider their cyber security options. The exposed information is significant for all parties. Thus, they must all take action to protect themselves. They can start by securing their accounts with new complex passwords and contact information; after, they should enable activity alerts and multi-factor authentication options everywhere. Those with information that individuals cannot easily change should invest in monitoring services; they are great for staying current on accounts—especially those not routinely monitored. Patients should also closely review their provider statements, explicitly looking for service discrepancies.