Colorado Health Network reports cyber attack affecting almost 70,000 individuals

Colorado Health Network disclosed a significant data security incident that compromised the sensitive personal information of nearly 70,000 individuals.

 

Colorado Health Network (CHN) is a Denver-based nonprofit that provides medical care, prevention, and support services for people living with or at risk for HIV, hepatitis C, and other sexually transmitted infections across Colorado.

 

In a data security incident notice published on its website, CHN said that last year, it identified unauthorised access within its internal network. The healthcare provider immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident. It also took steps to secure the affected systems and notified relevant law enforcement authorities about the same.

 

The investigation determined that an unauthorised individual viewed and obtained certain files from the healthcare provider’s internal network.

 

The compromised data included names, Social Security numbers, debit and credit card data,  financial account information, medical information, health insurance data, state-issued ID numbers including driver’s license, passport details and more.

 

In a filing with the Indiana state regulators CHN said it has identified at least 68,212 individuals including 257 people in Texas.

 

In a statement shared with the media, Darrell Vigil, CEO of CHN said, “We take the protection of personal information very seriously and regret any concern or inconvenience this incident may have caused.”

 

CHN has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

It has also offered complimentary identity protection and credit monitoring services through Epiq to all affected individuals.

 

In August, the Cephalus ransomware group claimed responsibility for the cyber attack on CHN and listed the healthcare provider as a victim on its data leak site. The group claimed it had exfiltrated more than 900 GB of confidential data, including patients’ personal information and protected health information (PHI) and threatened to publish the entire stolen dataset unless its ransom demands were met.