More than 600K patients affected in UNM Health hack

The University of New Mexico Overall health Technique began notifying sufferers before this month about a latest cybersecurity incident ensuing in probable knowledge publicity.

According to the system’s report to the U.S. Section of Overall health and Human Companies Workplace of Civil Legal rights, 637,252 individuals ended up influenced.  

UNM Overall health mentioned that on May two, an unauthorized 3rd occasion attained accessibility to its community and could have accessed or obtained certain data files. The overall health process learned the breach on June four, more than a month later.  

“1 of the more disparaging and tough troubles with knowledge breaches is the revelation of how lengthy the cybercriminals ended up inside of the organization’s community undetected,” observed James McQuiggan, security consciousness advocate at the instruction vendor KnowBe4.   

“Component of the cybercriminal’s repertoire is to silently work by an endpoint to the vital programs by using exploits and stolen credentials,” McQuiggan added.  

Following examining the data files, UNM Overall health decided that some patient data – these as names, addresses, dates of beginning, health-related record or patient identification quantities, overall health insurance plan information and minimal scientific data with regards to care – was contained in them. Some patients’ Social Safety quantities also ended up concerned.  

UNM Health’s digital overall health record was not obtainable, mentioned officers, who did not share any more details about the character of the incident.  

“UNM Overall health requires this situation extremely significantly and is getting techniques to assistance ensure some thing like this does not transpire yet again. UNM Overall health has offered extra education to workers and is improving the security of its programs and the data it maintains,” wrote reps in a see posted to the overall health system’s website.  

A cyberattack at Memorial Overall health

Midway throughout the nation, Memorial Overall health System’s overall health expert services ended up disrupted by a ransomware assault reportedly carried out by the Hive ransomware gang.  

“Memorial Overall health Technique is a nonprofit organization, which can make it an even more interesting focus on for cybercriminals for the reason that nonprofits are generally viewed as owning reduced defensive maturity and minimal cybersecurity expertise,” observed Stephan Chenette, cofounder and main engineering officer at the security optimization platform AttackIQ.  

The assault, which was learned early Sunday morning, pressured the Ohio-dependent Memorial to suspend user accessibility to IT applications. The overall health process canceled all urgent surgical circumstances and all radiology exams for Monday, with all principal care appointments held as scheduled.  

Workers at Memorial’s hospitals – Marietta Memorial, Selby and Sistersville Normal Clinic – also experienced to depend on paper charts although programs ended up restored.  

“Sustaining the basic safety and security of our sufferers and their care is our top precedence and we are carrying out almost everything attainable to lessen disruption,” mentioned Memorial Overall health Technique President and CEO Scott Cantley in a assertion.  

“At this time no regarded patient or staff individual or financial data has been compromised,” he added. “We are continuing to work with IT security professionals to methodically investigate to exactly comprehend what occurred and are getting the proper actions to take care of any and all troubles.”  

As of Wednesday, no updates experienced been posted to Memorial’s website or Fb webpage about process restoration.

Kat Jercich is senior editor of Health care IT News.
Twitter: @kjercich
E mail: [email protected]
Health care IT News is a HIMSS Media publication.