Esse Health, a healthcare service provider in St. Louis, Missouri, and the largest independent physicians’ group in the Greater St. Louis area, is sending out notification letters to more than 263,000 patients explaining their personal and health information has been stolen in a cyber attack the hospital suffered in April.
The cyber attack impacted primary patient-facing networks for the hospital, including its phone systems on April 21. It took Esse Health until June 2 to get all affected systems back online. During a follow-up investigation, it was discovered that the hackers were able to view and copy certain files, explains Esse Health privacy officer Jaime L. Bremerkamp in the breach notification letters being sent to 263,601 affected individuals as seen by BleepingComputer. The hospital also filed a report with Maine’s Attorney General.
Overall, the hackers were able to get away with the following data for each impacted patient:
- Names, addresses, birthdays
- Health insurance information
- Medical record numbers
- Patient account numbers
- Limited health information.
Esse Health has claimed that no evidence indicating theft of social security numbers has been found. Additionally, its NextGen electronic medical record system wasn’t breached either. Regardless, affected individuals are suggested to look into their account statements and monitor credit reports for any suspicious activity. The hospital is also providing free identity protection services via IDX if affected individuals enroll by September 25 — a standard practice for data breaches of this scale.
No technical details outlining the attack have been shared either. The recovery time, along with the amount of stolen data suggests a ransomware attack. However, no major ransomware group has claimed responsibility for the attack yet. Candid.Technology also didn’t find any databases related to the breach for sale on underground hacking forums either, suggesting that negotiations between hospital authorities and the hackers might still be underway if this was indeed a ransomware attack.
In the News: Canada bans Hikvision; company ordered to halt operations
