US healthcare company Fairfax reveals data breach affecting nearly 208,000 patients

Fairfax, a US-based healthcare company specializing in facial and dental care, has disclosed a data breach that may have impacted the medical records of nearly a quarter of a million patients.

The Virginia-based company reported that its investigation, concluded last month, revealed that a threat actor had infiltrated its systems in May.

Fairfax, which operates six surgical facilities across northern Virginia, promptly shared its findings with the attorney general in Maine. Maine imposes strict reporting requirements on companies experiencing cyberattacks that affect its residents. In this instance, fewer than 50 Maine residents were affected, but the breach’s total scope extends to 235,931 victims nationwide.

The exposed data includes sensitive information such as names, driver’s license numbers, Social Security numbers, and details related to health insurance and medical histories. Such information is highly sought after by cybercriminals for illegal monetization, often used in various criminal activities such as online fraud and identity theft.

Despite the breach, Fairfax has stated that there is no evidence to suggest that the exposed data has been used for malicious purposes. However, the company acknowledges that its clients may have been at risk since the infiltrators could have copied the exposed files without tampering with them.

In a statement, Fairfax said, "The investigation did not find evidence that any files were acquired from Fairfax’s network during the incident, and Fairfax is not aware of any instances of anyone’s personal information having been misused. Nevertheless, Fairfax notifies individuals whose personal information was on the encrypted systems."

Fairfax offers one year of free identity protection services to mitigate potential harm to affected customers. The company also assured that they have enhanced their technical security measures to reduce the risk of similar incidents.