Security Experts:

Connect with us

Hi, what are you looking for?



New York Emergency Services Provider Says Patient Data Stolen in Ransomware Attack

The personal information of roughly 320,000 individuals was compromised following a ransomware attack at New York-based ambulance services provider Empress EMS (Emergency Medical Services).

The personal information of roughly 320,000 individuals was compromised following a ransomware attack at New York-based ambulance services provider Empress EMS (Emergency Medical Services).

Founded in 1985 and located in Yonkers, the organization provides emergency transportation services, as well as emergency and non-emergency response services to hospitals, private care facilities, and correctional institutions. Empress EMS has more than 200 employees.

In a data breach notice posted on its website, Empress EMS reveals that on July 14, 2022, it identified a ransomware attack that resulted in some of its systems being encrypted.

The subsequent investigation into the incident has revealed that the attackers had gained access to the organization’s network in late May, and that they stole patient data before deploying ransomware on the compromised systems.

According to Empress EMS, the exfiltrated files contained personal information such as names and Social Security numbers, but also patient data such as dates of service and insurance information.

The emergency services provider says it has already started informing the impacted patients of the incident.

On September 9, Empress EMS informed the US Department of Health and Human Services that the incident impacted just over 318,000 individuals.

The organization did not provide further information on the type of ransomware that was used in the attack, but the Hive ransomware gang boasted to DataBreaches that they were behind the incident.

The Hive operators apparently contacted Empress EMS to inform them that they stole over 280 gigabytes of data, including business files, private company information, employee data, customer data, and more.

In July, Hive posted a brief about the attack on its leak site, but removed it shortly after, likely without making public any of the stolen information. It’s unclear whether Empress EMS paid a ransom to prevent the data leakage.

Related: Associated Eye Care Discloses Impact From 2020 Netgain Ransomware Attack

Related: Healthcare Technology Provider Omnicell Discloses Ransomware Attack

Related: Over 500,000 Patients Hit by Data Breaches at Healthcare Firms in Alabama, Colorado

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.


Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.


Expert Insights

Related Content


Zendesk is informing customers about a data breach that started with an SMS phishing campaign targeting the company’s employees.


Satellite TV giant Dish Network confirmed that a recent outage was the result of a cyberattack and admitted that data was stolen.


The release of OpenAI’s ChatGPT in late 2022 has demonstrated the potential of AI for both good and bad.


The changing nature of what we still generally call ransomware will continue through 2023, driven by three primary conditions.


As it evolves, web3 will contain and increase all the security issues of web2 – and perhaps add a few more.

Application Security

PayPal is alerting roughly 35,000 individuals that their accounts have been targeted in a credential stuffing campaign.


No one combatting cybercrime knows everything, but everyone in the battle has some intelligence to contribute to the larger knowledge base.


A recently disclosed vBulletin vulnerability, which had a zero-day status for roughly two days last week, was exploited in a hacker attack targeting the...