New York dialysis centre discloses data breach nine months after it took place

New York-based Atlantic Dialysis Management Services is notifying its patients about a cyber attack it suffered nine months ago.

In June 2022, DataBreaches reported that Atlantic Dialysis Management Services suffered a data breach, and a group of threat actors, known as the Snatch Team, listed the organisation on its data leak site.

Though DataBreaches made several attempts to contact the healthcare institution, it did not receive any response until early August when the hacker group started releasing the stolen data on its dark web site.

On August 5, ADMS finally published a notice on its website, stating that it detected “unauthorised activity within its computer systems”.

“On June 9, 2022, Atlantic Dialysis Management Services discovered certain unauthorized activity within its computer systems.  Upon discovery, ADMS immediately secured its network, reset passwords, and engaged a third-party forensic firm to investigate the incident.

“Following a thorough investigation, ADMS confirmed that a limited amount of patient information may have been accessed in connection with this incident. However, at this time, there is no indication whatsoever that any information has been misused or will be in the future,” the notice read.

According to ADMS, the compromised information included patient names, addresses, social security numbers, dates of birth, medical diagnosis and treatment information, health insurance information, and prescription information.

DataBreaches reported that on January 15, the Snatch Team published 39 GB of data stolen from ADMS and those files have been downloaded at least 62 times.

Atlantic Dialysis Management Services has started notifying individuals who were affected by the data breach and has submitted a copy of that letter to the Massachusetts Attorney General’s Office. The healthcare organisation, however, failed to inform those individuals that their information has been uploaded on the dark web and has been downloaded at least 62 times from the dark web.

ADMS also notified the U.S. Department of Health and Human Services Office for Civil Rights about the data breach on March 22, more than nine months after the company identified the security incident. The 14 reports filed by ADMS confirm that at least 19,972 individuals were affected by the security incident.

“Atlantic Dialysis Management Services, LLC (“ADMS”) writes to notify you of a recent incident that may impact some of your personal information described below. We take the privacy of information in our care seriously,” reads the letter sent by ADMS to affected patients.

“At this time, there is no indication that any information has been misused. However, ADMS is providing this notification to you out of an abundance of caution so that you may take steps to safeguard your information if you feel is it necessary to do so.

“ADMS has taken every step necessary to address the incident and is committed to fully protecting all of the information entrusted to us. As a safeguard, we have arranged for you to enroll, at no cost to you, in an online credit monitoring service for 24 months through Equifax.”