Mount Desert Island Hospital data breach compromised the data of over 32k patients

Maine-based Mount Desert Island Hospital suffered a major data breach that compromised the sensitive personal information of more than 30,000 patients and employees.

In a data breach notice filed with the Office of the Maine Attorney General, Mount Desert Island Hospital (MDIH) said that on 4th May, it suffered a cyber security incident that affected its internal network.

Immediately after identifying the incident, MDIH, along with external cyber security experts, launched an internal investigation to understand the nature and scope of the cyber attack.

“The investigation determined an unauthorised party gained access to certain files on the MDIH network between April 28, 2023 and May 7, 2023. Therefore, MDIH initiated a thorough review of the impacted portions of its network to determine the type of information contained therein and to whom the information related,” the hospital said.

While the review is still ongoing, the hospital has determined that current and former MDIH employees, patients, dependents, and beneficiaries have been impacted by the data breach.

The compromised information includes names, dates of birth, driver’s license numbers, state identification numbers, Social Security numbers, financial account information, medical record numbers, Medicare or Medicaid identification numbers, mental or physical treatment & condition information, diagnosis code & information, dates of service, admission/discharge dates, prescription information, billing & claims information, personal representative or guardian names, and health insurance information.

“MDIH began providing notice of this incident on its website on June 5, 2023. The website posting includes instructions for potentially impacted individuals to access complimentary credit monitoring and identity protection monitoring,” the hospital added.

In a regulatory filing with the Office of the Maine Attorney General on 17th July, MDIH said that at least 25,937 individuals were affected by the security incident. MDIH revised the number of impacted individuals in a later filing, stating that the sensitive personal information of at least 32,661 people was compromised.

“In response to this incident, MDIH conducted a full forensic investigation with the assistance of third-party specialists, changed password strength, implemented new technical safeguards, implemented periodic technical and nontechnical evaluations, bolstered firewall and user access policies, disabled vendor accounts associated with the suspected attack vector, and revised its policies and procedures,” MDIH added in its data breach notice.

The hospital has also provided 24 months of complimentary credit monitoring and identity protection services through IDX where affected individuals can enroll and safeguard themselves from cyber crimes involving their identity.