CommonSpirit caught up in MOVEit hack, Cook County
Breach Type –
Unknown, Data Breach
Becker Hospital Review
September 14th, 2023
- "Patients of Chicago-based CommonSpirit Health had their data compromised in the massive MOVEit hack that stole private information from millions of people across the globe.”
- "The affected patients received care at the former Centennial, Colo.-based Centura Health, which now operates under the CommonSpirit name, and were exposed via the use of Nuance Communications, a Microsoft subsidiary that listens to and documents medical appointments, according to a Sept. 13 notice from CommonSpirit. Nuance employed the MOVEit file transfer software from Progress Software that was hacked in late May"
- “The breached data may include patient and facility names, dates and types of service performed, and medical record numbers. The health system is mailing letters to affected patients..”
Read More
Morris Hospital investigating attack by Royal ransomware group, Grundy County
Breach Type –
Unknown, Other
DataBreahes.net
May 25th, 2023
- “Morris Hospital & Healthcare Centers is actively investigating a cybersecurity incident with the assistance of independent cybersecurity forensic experts. The incident has not impacted patient care or hospital operations.”
- ”The investigation was launched after the hospital detected unusual activity on its computer network that indicated an unauthorized third party had gained access to the network system. The network system is separate from the electronic medical record systems that are used for patient care. The hospital’s electronic medical record systems were not compromised."
- “Hospital officials emphasize that the numerous IT security measures that were already in place at Morris Hospital were instrumental in preventing a more severe incident.”
Read More
Lake County Health Department reports security breach that exposed residents’ health data, personal information
Breach Type –
Unknown, Data Breach
Lake & McHenry County Scanner
May 12th, 2023
- "The health department has announced they experienced a security breach in their email system that exposed some Lake County residents’ personal health data and private information.
Lake County officials announced late last week they became aware of the breach on March 6.”
- "It involved an unauthorized third-party gaining access to a Lake County Health Department and Community Health Center employee’s email account."
- ”The impacted email account included partially de-identified information regarding Lake County residents who may have had a reportable communicable disease or disease that was part of a cluster or outbreak that was investigated by the health department between April 23, 2012, and March 6, 2023."
-
“Information that may have been exposed includes names, addresses, zip codes, date of birth, gender, phone number, email address, medical record number, diagnoses or conditions, lab results and other treatment information used by the Communicable Disease outreach program."
Read More
Culbertson Memorial Hospital hit by cyber-attack, Schuyler County
Breach Type –
Unknown, Other
WGEM
April 7, 2023
- "Culbertson Memorial Hospital officials reported Friday the hospital had been the victim of a cyber-attack last week.
Officials stated they discovered a network disruption at 3 a.m. March 30 that required information systems to be taken offline.”
- ”Director of Community Relations Molly Sorrell said Friday that the hospital does not know if any of its health care or patient account information was compromised."
-
“Right now our focus is to get up and running and fully functional by Tuesday,” Sorrell said.
Snyder added, “while our investigation is ongoing, be assured Culbertson is working diligently to fully restore all systems so we can effectively serve the community. While we have regained the utilization to a portion of our systems, we expect to have fully restored critical service systems by April 11."
Read More
CommonSpirit Health cyberattack, month-long network outage cost $150M, Cook County
Breach Type –
Unknown, Data Breach
SC Magazine
February 15th, 2023
- "The ransomware attack and subsequent month-long network outage at CommonSpirit Health in October cost the major health system at least $150 million to date, according to its unaudited quarterly financial report.”
- "The “adverse financial impact” of the cyber incident is tied to the associated business interruption, remediation costs, and other related business expenses."
- "The health system posted $925 million in operating losses for the second half of 2022, of which the cyber incident was just a small portion. However, those losses were significantly larger than the year prior during the same period: just $128 million.”
- ”As extensively reported, a cyberattack was deployed against CommonSpirit during the first weekend in October that prompted outages and service disruptions at hospitals across the country. Despite being one of the largest health system’s in the U.S. with over 700 care sites and 142 hospitals in 21 states, only a small portion of those hospitals went down in the attack.”
- ”The disruptions, however limited in scope, were noticeable for the impacted hospitals. Clinicians leveraged protocols for handling system outages, but CHI Memorial was forced to reschedule some patient procedures. Virginia Mason Franciscan Health, another CommonSpirit affiliate, was also hard hit by the disruptions and saw its data stolen amid the hack.”
Read More
SC Magazine
February 15th, 2023
- "The ransomware attack and subsequent month-long network outage at CommonSpirit Health in October cost the major health system at least $150 million to date, according to its unaudited quarterly financial report.”
- “The “adverse financial impact” of the cyber incident is tied to the associated business interruption, remediation costs, and other related business expenses.”
- "The health system posted $925 million in operating losses for the second half of 2022, of which the cyber incident was just a small portion. However, those losses were significantly larger than the year prior during the same period: just $128 million.”
- “As extensively reported, a cyberattack was deployed against CommonSpirit during the first weekend in October that prompted outages and service disruptions at hospitals across the country. Despite being one of the largest health system’s in the U.S. with over 700 care sites and 142 hospitals in 21 states, only a small portion of those hospitals went down in the attack.”
- “The disruptions, however limited in scope, were noticeable for the impacted hospitals. Clinicians leveraged protocols for handling system outages, but CHI Memorial was forced to reschedule some patient procedures. Virginia Mason Franciscan Health, another CommonSpirit affiliate, was also hard hit by the disruptions and saw its data stolen amid the hack."
Read More
IL Social Services Organization Notifies 184K of Healthcare Ransomware Attack, Cook County
Breach Type –
Unknown, Ransomware
Health IT Security
January 30th, 2023
- "Lutheran Social Services of Illinois (LSSI) notified more than 184,000 individuals of a healthcare data breach recently, according to a breach notice provided to the Maine Attorney General’s Office. On January 27, 2022, LSSI discovered that it had fallen victim to a ransomware attack."
- ”Despite discovering the incident in January, LSSI did not complete its data review until December 28, 2022. By that time, the social services provider had determined that the unauthorized party accessed files containing certain sensitive information that was maintained on the impacted systems."
- "The affected data included names, Social Security numbers, dates of birth, financial information, biometric information, driver’s license numbers, health insurance information, and medical diagnosis and treatment information."
Read More
Citing cyberattack, COVID-19 impacts, Illinois hospital suspends operations, LaSalle County
Breach Type –
Unknown, Ransomware
SC Magazine
January 24th, 2023
- “St. Margaret’s Health has temporarily suspended operations at its hospital in Peru, Illinois, as its leadership could not “find nor financially support” a new provider for its emergency room department.
A cyberattack on St. Margaret’s Health’s Spring Valley Hospital and impacts of COVID-19 are cited as driving forces behind the decision."
- “The Spring Valley branch was struck by a cyberattack on Feb 22, 2021, prompting the launch of electronic health record downtime procedures and a complete enterprise network shutdown that lasted for several weeks. All web-based operating systems, such as email and the patient portal, were also brought offline.”
- ”Patient care continued without interruption, due to its previously implemented and practiced downtime procedures. However, the hospital was forced to divert its diagnostic imaging procedures to another hospital branch to ensure accuracy of scans. According to the letter sent to employees, these outages contributed to the hospital’s ongoing financial constraints.”.
- ”The letter cites a number of factors, including the cyberattack that led to the hospital being unable to “bill nor get paid, in a timely manner, for the services provided during the outage. The hospital was also facing staffing shortages that required the use of “temporary agencies to fill positions at a significantly higher pay rate.”
- ”The hospital has also struggled to “attract enough staff to continue to operate both hospitals.” As a result of these compounding factors, the hospital will no longer have ER physician coverage at its SMH-Peru branch beginning on Jan. 28 as hospitals aren’t legally allowed to operate without a fully staffed emergency room.”
Read More
CommonSpirit Health Suffers IT Outages, EHR Downtime at Multiple Hospitals, Cook County
Breach Type –
Unknown, Data Breach
Health IT Security
October 5th, 2022
-
“Multiple hospitals within the CommonSpirit Health system, one of the nation’s largest nonprofit healthcare systems, are reporting IT outages and EHR downtime.”
-
"October 05, 2022 - CommonSpirit Health confirmed that it has been suffering IT outages as a result of an unspecified IT security incident that began on October 3. The incident is impacting multiple facilities within the health system, forcing some hospitals to take their EHR systems offline.
CommonSpirit Health is one of the largest nonprofit healthcare systems in the US, with more than 1,000 care sites and 140 hospitals in 21 states."
-
“Our facilities are following existing protocols for system outages and taking steps to minimize the disruption. We take our responsibility to ensure the security of our IT systems very seriously,” a brief notice on the health system’s website stated.
- ”As a result of this issue, we have rescheduled some patient appointments. Patients will be contacted directly by their provider and/or care facility if their appointment is impacted.”
At MercyOne Des Moines Medical Center, the incident forced certain systems offline as a “precautionary step,” the Des Moines Register reported.
- ”The hospital had to divert ambulances away from its emergency department for a short period of time on Monday. The incident is also causing appointment cancellations in some locations.
The list of healthcare facilities impacted by the CommonSpirit incident continues to grow. CHI Health locations in Omaha confirmed that they were impacted by the security incident, along with Virginia Mason Franciscan Health (VMFH), Bergan Mercy Hospital.”
Read More
Illinois Clinic Says 503,000 Affected in Email Breach, Champaign County
Breach Type –
Hacking, Data Breach
GOV INFO SECURITY
April 12th, 2022
-
"A breach involving the compromise of a single user's email account at an Illinois-based multispecialty clinic has affected nearly 503,000 individuals. "
-
"Christie Clinic says it promptly launched an internal investigation to determine the nature and scope of the incident, and contacted federal law enforcement to mitigate the impact of the unauthorized access."
-
"The clinic's investigation confirmed that there was unauthorized access to the affected email account from July 14 to Aug. 19, 2021, and that intent of the unauthorized access was to intercept a business transaction between Christie Clinic and a long-standing, third-party vendor."
- "Information potentially contained in the affected email account included individuals' names, addresses, Social Security numbers, medical information and health insurance information,"
- "To date, Christie Clinic does not have any evidence of misuse of any patient information, but we have notified all individuals who have potential to be affected and notified all necessary regulators,"
Read More
31,000 patients' data compromised in Illinois health center ransomware attack, Cook County
Breach Type –
Hacking, Ransomware
Becker Hospital Review
February 16th, 2022
- "Family Christian Health Center reported that a ransomware attack had compromised the protected health information of 31,000 patients."
- "FCHC detected a ransomware attack on the health center's old dental system and electronic registration system. Attackers were able to access protected health information of patients who had received dental and healthcare services at the health center."
- "Patients who had received dental services prior to Aug. 31, 2020, had their names, birthdates, insurance card numbers, driver’s license numbers, and copies of their insurance cards and driver’s licenses compromised."
- "Patients who received healthcare services between Dec. 5, 2016, and Aug. 31, 2020, had their names, birthdates, addresses, insurance identification numbers and Social Security numbers compromised during the breach."
Read More
South Shore Hospital breach leaves 116,000 patients' data vulnerable, Cook County
Breach Type –
Hacking, Data Breach
Becker Hospital Review
February 15th, 2022
- "South Shore Hospital notified current and former patients about a cybersecurity incident that left 115,670 patients' protected information vulnerable."
- "The hospital was alerted that unauthorized activity was occurring on its network. The hospital activated emergency operating protocols and hired a security team to investigate the matter."
- "The attacker gained access to files that contained patients' and employees' first and last names, addresses, dates of birth, Social Security numbers, financial information, health insurance information, medical information, diagnoses, health insurance policy numbers, and Medicare and Medicaid information."
Read More
Cyberattackers Hit Data of 80k Fertility Patients, State of Illinois
Breach Type –
Hacking, Data Breach
Threat Post
January 7th, 2022
- "The protected health information of nearly 80,000 patients of Fertility Centers of Illinois (FCI) may have been pawed over by cyber intruders following a cyberattack."
- "FCI runs four clinics across Illinois. According to the U.S. Department of Health and Human Services (HHS) Office for Civil Rights’ data breach site, the breach – reported on Dec. 27 – affected 79,943 people."
- “FCI’s data breach notice (PDF) said that the healthcare organization first detected suspicious activity on its internal systems on Feb. 1, 2021. A subsequent investigation indicated that security systems had blocked attackers from accessing patient EMR (electronic medical records) systems. However, the intruder(s) managed to access administrative files and folders."
- “The accessed files included some patients’ names, employer-assigned ID numbers, passport numbers, Social Security numbers, financial account information, payment card information, treatment information, diagnosis, treating/referring physicians, medical record number, medical billing/claims information, prescription/medication information, Medicare/Medicaid identification information, health insurance group numbers, health insurance subscriber numbers, patient account numbers, encounter numbers, ill health/retirement information, master patient index, occupational-health related information, other medical benefits and entitlements information, other medical ID numbers, patkeys/reason for absence, sickness certificate, usernames and passwords with PINs or account login information, and medical facilities associated with patient information."
Read More
Hackers had access to OSF Healthcare's IT systems for 6 weeks before outage, Peoria County
Breach Type –
Unknown, Data Breach
Becker Hospital Review
October 5th, 2021
- "Peoria, Ill.-based OSF HealthCare began notifying patients Oct. 1 that their protected health information was exposed for more than six weeks during an attack on its IT systems earlier this year."
- ”OSF HealthCare experienced a computer systems outage from April 23-25, which sent the health system into downtime procedures and protocols for two days"
- ”OSF HealthCare said the outage was the result of a data security incident. After investigating the incident, the health system discovered that an unauthorized party gained access to its systems from March 7 to April 23. As a result, the hacker was able to access certain files belonging to some patients at OSF Little Company of Mary and OSF Saint Paul."
- "Patient information exposed by the incident included names, birthdates, Social Security numbers, treatment details, prescription details and health insurance details. Financial information belonging to a "smaller subset of patients" also was exposed"
Read More
600,000 patients' info exposed in cyberattack on Illinois medical group, DuPage County
Breach Type –
Unknown, Data Breach
Becker Hospital Review
August 31st, 2021
-
"DuPage Medical Group is notifying 600,000 patients that their personal health information was exposed when the Downers Grove, Ill.-based medical group's computer network was hacked in July"
-
"DuPage Medical Group... discovered the unauthorized activity on its computer network July 13. As a result, the group shut down access to its network and medical records for nearly a week."
-
"The hacker had access to DuPage Medical Group's computer network July 12-13 and compromised the following information of the group's patients: names, birthdates, addresses, diagnosis codes, and Social Security numbers for a small number of people, among other details."
-
"No evidence that any information has been subject to actual or attempted misuse as a result of this incident."
Read More
Malware Attack Exposes IL Health Centers' Patient and Staff PHI, Cook County
Breach Type –
Unknown, Malware
Health IT Security
August 6th, 2021
-
“Dynamic Health Care, Inc. (DHC) of Illinois issued a data incident notice on July 16, notifying its patients and staff of “a recent event that may affect the privacy of information of certain nursing care facility patients and employees for whom it provides consulting, administrative, and back-office services,”
-
"DHC found malware on its computer systems on November 8, 2020"
-
“Through this investigation, DHC determined that in connection with the malware event, an unauthorized actor accessed certain systems within its network on or about November 8, 2020.”
-
"The breached data includes patients’ and/or staff members’ names, dates of birth, Social Security numbers, treating nursing care facility names, and may include a resident identification number and dates of admission and/or discharge, the notice states."
- “Following this incident, DHC took immediate steps to improve the security of its environment and increase its security posture. DHC is also implementing additional training and education to its employees to prevent similar future incidents.”
Read More
Lake County Health Department Announces Two Data Breaches Impacting Nearly 25,000 Patients, Lake County
Breach Type –
Unknown, Data Breach
Lake & McHenry Scanner
July 18th, 2021
- "The Lake County Health Department announced two data breaches, one of which occurred in 2019, that compromised the data of almost 25,000 people."
- -"…that the first breach, which was disclosed earlier this month, occurred after an unencrypted email was sent to an internal employee’s personal email address."
- “The spreadsheet consisted of medical records requests from December 2016 to June 2019 made through a third-party vendor who provides release of information services.24,241 people were impacted and the health department mailed them a letter on July 2 notifying them of the breach."
- "The second breach involved an unencrypted Google spreadsheet used by volunteers and staff, The spreadsheet contained names, dates of birth, phone numbers, email addresses and vaccination status of seniors seeking information on the COVID-19 vaccine."
- "705 people were impacted in the second breach and the health department has since notified them via mail about what happened."
- ”The health department determined no one’s personal health information was compromised in the first breach but federal authorities disagreed and said the information could have been compromised."
Read More
Cancer Treatment Centers of America Midwestern Regional Medical Center, Cook County
Breach Type –
Hacking, Data Breach
Becker's Hospital Review
March 25th, 2021
-
Email hack breached 104,808 patients' data
-
Compromised information may include patient names, medical data, and health insurance information
-
The affected email account has been disabled, and CTCA recommends that affected individuals monitor their benefit statements
Read More
Southern Illinois University School of Medicine, Jackson County
Breach Type –
Hacking, Data Breach
Health IT Security
March 11th, 2021
-
Vulnerabilities in Accellion's File Transfer Appliance were exploited by Clop ransomware threat actors
-
Compromised information for SIU School of Medicine patients may include names, dates of birth, SSNs, driver's licenses, treatment plans, and insurance information
-
SIU has terminated use of the FTA and is offering complimentary identity theft protection to those whose SSNs and/or driver's licenses were exposed
Read More
OSF Healthcare System, Peoria County
Breach Type –
Unknown, Data Breach
Data Breaches
October 20th, 2020
-
OSF health care system is forced to Mail letters to patients advising them of Blackbaud attack
-
OSF investigations of Blackbaud database determined that some sensitive patient information was exposed
-
The health system did not notify in a public release how many patients were being contacted
Read More
NorthShore University Health System, Cook County
Breach Type –
Unknown, Data Breach
Chicago Tribune
September 11th, 2020
-
Nearly 348,000 individuals potentially had information leaked
-
Names, birth dates, addresses, and medical information possibly accessed
-
University reported cyberattack to federal health agency
Read More
Northwestern Memorial Health Care, Cook County
Breach Type –
Unknown, Data Breach
Becker's Hospital Review
September 3rd, 2020
-
Northwestern Memorial Health Care was also a victim of large scale Blackbaud breach
-
Blackbaud notified many organizations of exposure that bad actors had gained access between Feb. and May
-
The bad actors were able to access a backup server taking donor and patient information, Blackbaud believes that the information is not being misused
Read More
R1 RCM, Cook County
Breach Type –
Unknown, Ransomware
Krebson Security
August 14th, 2020
-
R1 RCM had rendered servers offline in response to ransomware attack
-
The company has access to may forms of private personal sensitive data
-
It is believed the attack took place a week prior to public statements.
Read More
FHN Memorial Hospital, Stephenson County
Breach Type –
Phishing, Data Breach
Journal Standard
August, 3rd, 2020
-
The hospital notified its patients of bad actors gaining access to employee email accounts potentially exposing patients
-
To assess damages the hospital reviewed all the email attachments to evaluate potentially exposed patient information
-
Information that was accessed includes patients’ names, dates of birth, medical records, and/or Social Security numbers
Read More
Carle Foundation Hospital, Champaign County
Breach Type –
Phishing, Data breach
Security
September 14th, 2019
-
Hospitals in Illinois victim of phishing scam
-
Three hospitals suffered breach of data
-
Unspecified number of patients' information affected
Read More
Center for Vitreo-Retinal Diseases, Lake County
Breach Type - Ransomware
Data Breaches
November 29th, 2018
- Servers impacted by ransomware attack
- Hackers may have viewed private information of patients
- 20,300 patients potentially affected in data breach
Read More
Medspring Urgent Care, Cook County
Breach Type - Phishing, Data Breach
Data Breaches
August 9th, 2018
- Illinois Medspring employee falls victim to phishing scam
- Some patient personal information contained in email account
- 13,000+ patients potentially affected
Read More
BACK TO TOP
