Weekly Cybersecurity Recap December 15

This week, cybercriminals again targeted US medical records and patient identities. The attacks started with a 2.5 million record breach from Kentucky’s Norton Healthcare circuit, including data from pediatric patients. On the other side of the country, cybercriminals also targeted Oregon’s Neuro Center of the Cascades; the attack spilled over 20k records into the hands of criminals. Southern Illinois’ Harrisburg Medical Center also announced a significant breach this week, although the event happened nearly a year ago. The last breach of the week was also healthcare-based—Phoenix’s CVC lost 484k records in a cyberattack. Healthcare providers weren’t the only victims of this week’s breaches either; Anheuser-Busch’s major distributor network, Ben E. Keith, also fell victim to a cyber assault, creating almost 40k victims. Find a synopsis of each event below.

Norton Healthcare

Spanning over 400 locations between Kentucky and Indiana, Norton’s breach included the data of 2.5 million patients. Those impacted in the breach include current and former patients, employees, and their dependents, including minors. The information includes full names, dates of birth, Social Security Numbers (SSNs), contact details, insurance and health information, medical information, digital signatures, driver’s license numbers, and some financial account credentials. All those with a relationship with Norton Healthcare should take up monitoring services to defend their sensitive accounts.

Ben E. Keith

A massive food and beverage distributor in Texas and the surrounding states, BEK, offered an update on their March data breach. Victimized by a ransomware event, BEK’s breach included data from employees and associates. The compromised information includes names, SSNs, dates of birth, addresses, government ID numbers, health insurance information, medical details, and financial account information like payment methods and details. BEK employees and associates must consider defensive data options to protect their data from criminal misuse. 

Neuromusculoskeletal Center of the Cascades

In Oregon, 22,000 patients had their data exposed in a breach incident from two employee email accounts. The attack included significant amounts of sensitive data, including names, contact information, birthdays, SSNs, financial account data (account numbers, routing numbers, financial institution name, and credit/debit card numbers), and medical information (health insurance numbers, Medicare/Medicaid ID numbers, medical records, prescription information, and diagnosis/treatment details). In response to this event, all patients within the clinic network must act to protect themselves; the stolen information is too vital to wait for further instruction.

SIH’s Harrisburg Medical Center

The HMC suffered a cyber event almost a year ago; it involved information stolen from over 147k patients, ranging from public data to sensitive details. The data purportedly includes names, dates of birth, SSNs, medical details like prescriptions, diagnoses, and treatments, health insurance information, driver’s license numbers, electronic signatures, and financial account details. HMC sent preliminary notices in February and again in August; however, their investigations have finally concluded this week—resulting in officials sending more notices.

Cardiovascular Consultants Ltd.

A consultant group, the CVC, lost significant information after an unauthorized party accessed and encrypted their system files. Although this event happened in September, they have only recently announced it publicly. Impacted parties include patients, account guarantors, and insurance policyholders. The stolen data differs between parties but mainly includes names, residential addresses, contact information, demographics, SSNs, medical and billing information, diagnosis and treatments, and birthdays. The event may impact 484,000 individuals, based on the filing published on the Department of Health and Human Services website.