Arisa Health data breach affects over 375,000 individuals

Arkansas-based integrated behavioral health system, Arisa Health Incorporated has disclosed a significant breach of protected health information, affecting 375,436 individuals. This follows a cyberattack that disrupted network connectivity on March 18, 2024. A forensic investigation revealed unauthorized network access from March 1, 2024, to March 18, 2024, with possible exfiltration of sensitive patient data.

The exposed information includes full names, addresses, email addresses, dates of birth, Social Security numbers, medical record numbers, health insurance numbers/member IDs, substance abuse program completion certification, medical histories and diagnoses, and driver’s license numbers. The breach impacts Arisa Health patients and individuals receiving services from its subsidiaries: Counseling Associates, Inc., Northeast Arkansas Community Mental Health Center (d/b/a Mid-South Health Systems), Ozark Guidance Center, Inc., and Professional Counseling Associates, Inc.

Arisa Health has offered complimentary credit monitoring services to individuals whose Social Security numbers were exposed. The organization emphasizes its ongoing commitment to enhancing privacy and security measures adapting policies and practices to prevent future incidents. The breach has been reported to the Department of Health and Human Services’ Office for Civil Rights.

Although Arisa Health has not explicitly labeled the incident as a ransomware attack, the Hunter’s International ransomware group has claimed responsibility. This group was also implicated in a recent attack on the Northeast Rehabilitation Hospital Network.

In addition to Arisa Health, cyberattacks have been reported by Sun City Pediatrics in Texas and Calibrated Healthcare in California, indicating a troubling trend in healthcare data security breaches across the United States.