Hackers used compromised email account to steal Acadia Healthcare's patient data

Behavioural care provider Acadia Healthcare said threat actors compromised an employee’s email account and stole emails and SharePoint files contained patients’ sensitive healthcare data.

 

The Franklin, Tennessee-based behavioural health treatment provider said in a press release that on May 25, it detected suspicious activity associated with a user’s email account. An investigation into the unusual activity revealed that a third party had conducted a social engineering attack to compromise the user’s email account and an associated SharePoint account.

 

The initial compromise occurred on May 21 and was detected and removed on May 25. In those four days, the threat actor gained access to and acquired certain emails and SharePoint files that contained patients’ personal and healthcare information. 

 

Acadia Healthcare said the cyber attack did not compromise its electronic health record systems and did not disrupt its operations or its ability to provide treatment to patients.

 

"A review was initiated to determine the contents of those emails and files involved in the incident. Through this ongoing review, files containing patient information have been identified, including names, addresses, dates of birth, treatment information, dates of treatment, type of treatment, and health insurance information," the healthcare provider said. 

 

"For some individuals, the files also contained their Medicare Health Insurance Claim Number (HICN), which may include their Social Security number," it added.

 

Acadia Healthcare operates a network of over 225 facilities across the United States and Puerto Rico. These include over 50 inpatient psychiatric hospitals in 19 U.S. states, as well as 165 methadone clinics which provide medications for opioid use disorders. 

 

The for-profit healthcare organisation employs more than 22,000 people and serves an average of 70,000 patients per day for behavioural problems and conditions such as post-traumatic stress disorder, trauma, eating disorders and substance abuse. In 2022, it was the largest behavioural treatment hospital chain in the U.S.

 

The hospital chain has urged all affected patients to review any statements they receive from their healthcare providers and health insurance plans and to contact it on a dedicated toll-free landline number if they have any questions about the incident or its impact on their personal information.

 

"To help prevent something like this from happening again, we have implemented, and will continue to adopt, additional safeguards and technical security measures to further protect and monitor our systems.

 

"We are committed to protecting the confidentiality and security of the information we maintain. We regret any inconvenience or concern this incident may cause and take this matter seriously," Acadia Healthcare said.