Chinese Group Believed Responsible for Community Health Systems Attack That Exposed Personal Information of 4.5 Million Patients
Community Health Systems, Inc., one of the largest hospital operators in the United States, has suffered a data breach that affects millions of individuals, the organization revealed on Monday.
According to the company, the hackers managed to steal the records of 4.5 million patients who were referred for or received services from affiliated doctors affiliated in the last five years. The compromised information includes names, addresses, birth dates, phone numbers and social security numbers.
Financial, medical or clinical information has not been obtained by the attackers, Community Health Systems said. However, the company is notifying affected individuals and offering them identity protection services.
FireEye-owned Mandiant was hired to investigate the incident and determined that the intrusion took place in April and June 2014. Forensics specialists believe that this is the work of a Chinese advanced persistent threat (APT) group that leverages sophisticated malware and techniques in its attacks.
The activities of the group in question appear to be well known by both Mandiant and the federal law enforcement agencies called in to investigate the incident and possibly prosecute the culprits. The perpetrators are typically after intellectual property, such as medical device and equipment development data, investigators said.
Mandiant is known for its research on cyber espionage operations that originate in China. In fact, the company became famous in February 2013 after it released a controversial report accusing China’s People’s Liberation Army (PLA) of sponsoring a sophisticated campaign.
A couple months later, the security firm noted that the attackers had gone quiet after the report was made public, a fact also confirmed last week to SecurityWeek by Lockheed Martin.
Community Health Systems is confident that it has removed the malware used by the attackers from its systems. In addition, the organization says it has taken steps to protect its networks against future cyberattacks of this nature.
The company has clarified that it has cyber and privacy liability insurance to protect it against losses related to such incident. While the breach may result in remediation expenses, regulatory inquiries, litigation and other liabilities, Community Health Systems does not believe it will have a negative impact on business or financial results.