Illinois-based Cook County Health says third party vendor breach impacted over 1.2m patients

Illinois-based healthcare company Cook County Health said it suffered a significant data breach as a result of a data security incident suffered by a third party vendor.

In a data security incident notification posted on its website, Cook County Health (CCH) said that on July 21, Perry Johnson & Associates (PJ&A), a third-party firm which once provided medical transportation services for its patients, discovered that it suffered a security incident that impacted several of its systems, including those that stored data of Cook County Health’s patients and staff.

PJ&A immediately launched an internal investigation with assistance from external cyber security experts to understand the nature and scope of the security incident and notified the FBI.

“The investigation found that an unauthorised individual accessed PJ&A systems where CCH patient data was stored in April 2023. On July 26, 2023, PJ&A informed CCH that personal information of CCH patients may be affected,” CCH said.

Immediately after being notified about the data security incident, CCH acted promptly and stopped sharing any further data with PJ&A and terminated its relationship with the company. On October 9, PJ&A handed over to CCH the final list of affected patients.

The list revealed that at least 1.2 million patients had their personal data compromised in the data breach. The compromised data included their names, dates of birth, addresses, medical record numbers, encounter numbers, medical information, and dates and times of service. Approximately 2,600 of those patient records also included Social Security Numbers.

CCH says it has no reason to believe that the compromised data has been misused, but the possibility for the same cannot be ruled out. CCH has started notifying all the affected individuals about the breach and has urged them to remain vigilant and monitor their credit reports and place freezes on them, if needed.

“For those patients whose Social Security numbers may have been impacted, CCH will offer them the opportunity to enroll in credit monitoring and identity protection services at no cost,” CCH added.