Ohio dialysis provider says data breach exposed patients’ and employees’ sensitive data

Ohio-based Centers for Dialysis Care has disclosed that a data security incident earlier this year compromised the sensitive personal information of patients and staff.

 

Centers for Dialysis Care is a nonprofit dialysis provider headquartered in Cleveland, Ohio. The organization operates multiple outpatient dialysis centers across Northeast Ohio, offering dialysis treatment and kidney care services to patients with chronic kidney disease and end-stage kidney disease.

 

In a data security incident notice published on its website, Centers for Dialysis Care said that on March 20, it identified unauthorised access within its internal network. The healthcare provider immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

It also took steps to secure the affected systems and notified relevant law enforcement authorities about the same.

 

“With the support of cybersecurity experts, we learned of information suggesting that an unknown actor gained unauthorised access to our network and accessed files, some of which contained protected health information and/or protected personal information,” Centers for Dialysis Care said.

 

The compromised data included names, Social Security numbers, dates of birth, medical information, health care treatment and diagnostic information, health insurance information, tax and financial information. In a filing with the U.S. Department of Health and Human Services, Centers for Dialysis Care said it has identified 8,000 individuals affected by the incident.

 

“We take the security of patient and employee information very seriously. We have implemented additional measures to enhance network security and minimise the risk of a similar incident occurring in the future. We notified the Department of Health and Human Services and the FBI, and we will cooperate with any resulting investigation, providing whatever cooperation may be necessary to hold the perpetrators accountable,” the healthcare provider added.

 

Centers for Dialysis Care has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

At the time of publishing, no known hacker group claimed responsibility for the cyber attack on Centers for Dialysis Care. The healthcare provider also did not share details on who was behind the attack, how much data was compromised, or whether it had received a ransom demand.