Nevada hospital ransomware attack could affect data of 1.3M patients

By Kat Jercich for Healthcare IT News

The University Medical Center Southern Nevada has reported that a ransomware attack earlier this summer affected the data of 1,300,000 people.

The organization said in a statement that the incident only lasted a day, but the bad actors were able to compromise some files on network servers.

“Out of an abundance of caution, UMC will directly notify every person potentially affected by the June cyberattack and provide them with complimentary access to identity protection services,” said UMC in a statement in late July.

WHY IT MATTERS 

Analysts pointed to REvil, a Russia-linked ransomware group, as the culprit.

The group has reportedly extorted upwards of $12 million from victims in 2021. But in mid-July, just after the UMC incident, it appeared to vanish from the Internet.

UMC says it has no evidence to date that cybercriminals accessed any clinical systems, including those connected to its electronic health records.

However, the compromised files did contain protected health information and personally identifiable information, potentially including:

• Demographic information (name, address, date of birth and Social Security Number)
• Clinical information (history, diagnosis and test results)
• Financial information (insurance number)

Just after the attack, REvil posted images of driver’s licenses, passports and Social Security cards of around half a dozen alleged victims on its website, according to local outlets.

“UMC has notified the FBI and the Las Vegas Metropolitan Police Department. In addition, UMC is engaged in a number of security initiatives, including working closely with external cybersecurity professionals and updating internal and external technology solutions to further safeguard UMC against cyberattacks,” said UMC in a statement.

This week, the Ohio-based class action law firm Markovits, Stock and DeMarco announced that it was investigating claims on behalf of breach victims. The firm encouraged those who received a notification about the breach to contact its attorneys about potential legal remedies.

THE LARGER TREND

The financial impact of ransomware can go beyond the ransom itself – although that can be a hefty sum.

Depending on the extent of the incident, costs can add up from decreased patient activity. And patient legal action can pile on the bills. Most recently, Scripps Health in San Diego was hit with class action suits after a ransomware attack took down its network for weeks.

ON THE RECORD

“Cyberattacks such as this are increasingly common among hospitals and other organizations across the world, with many cybercriminals intending to use compromised information for commercial gain,” said UMC in a statement.