Chattanooga Heart Institute says data breach compromised about 550,000 patients' healthcare data

Tennessee-based cardiovascular practice Chattanooga Heart Institute said a data security incident has compromised the sensitive personal information of almost 550,000 individuals.

 

In a data breach notice filed with the Office of the Maine Attorney General, the healthcare provider said that on April 17, it identified a cyber security incident affecting its internal network. The institute said it immediately launched an investigation to understate the nature and scope of the intrusion.

 

“The investigation determined that an unauthorised third party gained access to The Chattanooga Heart Institute’s network between March 8, 2023, and March 16, 2023," it said, adding that it determined on May 31 that the malicious actor obtained copies of some of the data from its systems, including patients’ confidential information.

 

The compromised information includes patients’ or their guarantors’ names, mailing addresses, email addresses, phone numbers, dates of birth, driver’s license numbers, Social Security numbers, account information, health insurance information, diagnosis and condition information, lab results, medications and other clinical, demographic and financial information.

 

“Upon discovering the unauthorised third party access, the Chattanooga Heart Institute took quick action to protect its systems, contain the incident, begin an investigation, and maintain continuity of care.

 

“In addition, the Chattanooga Heart Institute notified federal law enforcement. Once secured, systems were returned to the network with additional security and monitoring tools,” the institute added.

 

In an initial filing with the Office of the Maine Attorney General, the healthcare provider said that the data security incident affected 170,450 individuals. However, in a second filing with the regulator, it declared that at least 411,383 individuals were affected by the data security incident.

 

On March 28, the Institute said that it has so far identified 547,434 individuals whose sensitive personal data was compromised in the cyber security incident.

 

The healthcare provider has urged afected patients to remain vigilant, monitor their credit reports on a regular basis, and report any discrepancy to relevant credit agencies and law enforcement authorities. It is also providing a year of complimentary credit monitoring and identity theft restoration services to all affected individuals.

 

On May 27, the Karakurt ransomware group claimed responsibility for the cyber attack on Chattanooga Heart Institute and listed the healthcare provider as a victim on its data leak site. The group claimed to be in possession of 158 GB of data stolen from the heart institute that includes medical records, test results, diagnoses, social security numbers, passports, addresses, phone numbers, financial data and other medical documents.