Mount Kisco Surgery data breach impacted over 21,000 patients

New York-based healthcare organisation Mount Kisco Surgery said it experienced a data security incident that compromised the sensitive personal information of more than 20,000 individuals.

 

In a data breach notice filed with the Office of the Maine Attorney General, Mount Kisco Surgery, doing business as the Ambulatory Surgery Center of Westchester (ASCW), said that on November 3, it identified suspicious activities on its internal network.

 

The healthcare provider immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

“The investigation revealed that certain emails within the employee’s account may have been accessed or acquired without authorisation between October 23, 2023, and November 3, 2023.

 

“On May 30, 2024, we identified that some of your personal and/or protected health information was contained in the account,” Mount Kisco said in a letter addressed to affected patients.

 

The compromised data includes patients’ names, Social Security numbers, driver’s license or state identification numbers, dates of birth, medical information, including diagnosis information, treatment information, and prescription information, and health insurance information, including claim information and health insurance ID numbers, and financial account information.

 

The healthcare provider’s filing with the Maine state regulator revealed that at least 21,073 individuals were impacted by the incident.

 

“ASCW has implemented additional measures to enhance network security and minimise the risk of a similar incident occurring in the future,” the healthcare provider said in its press release.

 

While ASCW found no evidence of the compromised information being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

It has also offered one year of complimentary identity protection and credit monitoring services through IDX to all affected individuals.