Chicago’s Lurie Children’s hospital says cyber attack impacted close to 800,000 patients

Chicago-based Ann & Robert H. Lurie Children’s Hospital said that a data security incident it suffered earlier this year compromised the sensitive personal information of almost 800,000 individuals.

In a data security incident notice filed with the Office of Maine Attorney General, Ann & Robert H. Lurie Children’s Hospital, known as Lurie Children’s, said that between January 26 and 31, threat actors gained unauthorised access to its internal network.

The hospital said it took immediate steps to secure the affected network and contain the spread of the attack. It also launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

The investigation revealed that the sensitive personal information of its patients was compromised during the incident. The affected information included patients’ names, addresses, dates of birth, dates of service, as well as more sensitive information like Social Security numbers, medical records, prescription information, health claims information, and treatments and procedures received.

The healthcare provider’s filing with the Maine state regulator’s Office revealed that at least 791,784 individuals were impacted by the incident.

Lurie Children’s has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and state attorney general. It has also offered two years of complimentary identity protection and credit monitoring services through Experian to all affected individuals.

In February, the Rhysida ransomware group claimed responsibility for the cyber attack on the hospital and listed it as a victim on its data leak site. The group claimed to be in possession of 600GB of data stolen from the hospital and demanded a ransom of 60 Bitcoin in exchange for a decryption key.