ENT care provider Otolaryngology Associates says ransomware attack impacted over 316k patients

Indiana-based healthcare services provider Otolaryngology Associates said it experienced a major data security incident that compromised the sensitive personal information of more than 316,000 individuals.

 

Headquartered in Indianapolis, Otolaryngology Associates is a specialty provider of Ear, Nose and Throat care. The healthcare practice employs about 125 people and operates across 13 locations in the state of Indiana.

 

In a data security incident notice published on its website last week, Otolaryngology Associates (OA) said that on February 17, it identified a cyber security incident affecting its systems and immediately launched an internal investigation, with assistance from third party cyber security experts, to understand the nature and scope of the incident.

 

OA, however, clarified that it had continuous access to its systems and was never locked out of its systems.

 

“On February 20 and 21, 2024, the attacker sent three communications claiming to have stolen some of our data and threatening to release the stolen data publicly. We promptly took steps to further secure our information systems and investigate the incident, including contacting the FBI and hiring a forensic cybersecurity response firm,” the practice said.

 

“As a result of the investigation, it was ultimately determined that the attacker did not view individual documents, but ran programs to exfiltrate (take) some data from OA systems.”

 

OA added that the threat actor did not gain access to the medical records system, but still managed to obtain access to staff and patients’ protected healthcare information.

 

The compromised data includes names, Social Security numbers, driver’s license numbers, addresses, email addresses, telephone numbers, dates of birth, OA medical record number, a code related to the services provided, dates of service, treating physician name, appointment location, appointment schedules, referral forms, names of insurance company, and insurance plan numbers.

 

For affected OA staff, the compromised information includes financial data, including bank account details and payroll information.

 

While the data security notice doesn’t state the number of affected individuals, OA said in a filing with the U.S. Department of Health and Human Services Office for Civil Rights that at least 316,802 individuals were affected by the data breach.

 

“OA takes the protection of information seriously. In addition to engaging a cybersecurity response firm, OA promptly took (and continues to take) other actions to further protect its patients, staff, and systems post-incident, including implementing additional security measures.

 

“OA continues to monitor the situation closely. OA’s cybersecurity firm has been monitoring the dark web, and at the time of this notification letter, no evidence has been found of any OA documents,” the company added. It also found that the data security incident did not compromise the data of OA Facial Plastics patients and staff.

 

On March 27, the INC ransomware group claimed responsibility for the cyber attack on OA and listed the company as a victim on its data leak site.