Medical Review Institute of America (MRIoA) on Friday started notifying some individuals that their personal information was compromised in a cyberattack.
The incident, MRIoA says, was discovered on November 9, 2021. A couple of days later, the organization discovered that personal information was compromised in the attack and, by November 16, it had managed to retrieve it.
The investigation into the incident has revealed the theft of protected health information such as names, gender, physical and email addresses, phone numbers, birth dates, Social Security numbers, full clinical information (including diagnosis, treatment, medical history, and lab test results), and financial information (such as health insurance policy and group plan number).
MRIoA says it has taken steps to strengthen its security. It has implemented additional multifactor authentication protections, replaced its servers with new ones and deployed a hardened backup environment, revised its cybersecurity policies, and enhanced employee training.
In a data breach notification submitted to the Maine Attorney General’s Office, MRIoA said that over 134,000 individuals were impacted by the incident.
The organization has not shared any information on the type of cyberattack it fell victim to. However, it did say that, immediately after the incident, it “took steps to secure and safely restore its systems and operations,” which suggests that ransomware might have been involved.
Furthermore, the organization said it “retrieved and subsequently confirmed the deletion of” the stolen data, which suggests that MRIoA contacted the attackers and negotiated with them.
SecurityWeek has emailed MRIoA to confirm that ransomware was indeed involved in the incident and to ask whether a ransom was paid, but has yet to receive a response.
Related: Online Pharmacy Service Ravkoo Discloses Data Breach
Related: Broward Health Data Breach Impacts 1.3 Million People
Related: Saltzer Health Says Patient Data Exposed in Cyberattack
More from Ionut Arghire
- 500k Impacted by Data Breach at Debt Buyer NCB
- Chinese Cyberspies Use ‘Melofee’ Linux Malware for Stealthy Attacks
- Microsoft Cloud Vulnerability Led to Bing Search Hijacking, Exposure of Office 365 Data
- OpenAI Patches Account Takeover Vulnerabilities in ChatGPT
- New Wi-Fi Attack Allows Traffic Interception, Security Bypass
- Casino Giant Crown Resorts Investigating Ransomware Group’s Data Theft Claims
- Over 200 Organizations Targeted in Chinese Cyberespionage Campaign
- Nigerian BEC Scammer Sentenced to Prison in US
Latest News
- 500k Impacted by Data Breach at Debt Buyer NCB
- Chinese Cyberspies Use ‘Melofee’ Linux Malware for Stealthy Attacks
- Why Endpoint Resilience Matters
- Microsoft Cloud Vulnerability Led to Bing Search Hijacking, Exposure of Office 365 Data
- 3CX Confirms Supply Chain Attack as Researchers Uncover Mac Component
- UK Introduces Mass Surveillance With Online Safety Bill
- Musk, Scientists Call for Halt to AI Race Sparked by ChatGPT
- Malware Hunters Spot Supply Chain Attack Hitting 3CX Desktop App
