Blackbyte ransomware group hacked Kisco Senior Living, stole the data of 26k customers

California-based old age home provider Kisco Senior Living says it experienced a major cyber security incident last year that compromised the sensitive personal information of more than 25,000 individuals.

 

In a recent filing with the offices of the Maine Attorney General and the California Attorney General, Kisco said that on June 6 last year, it suffered a network disruption and launched an internal investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident. It also took steps to secure the affected network environment.

 

“The investigation determined that certain files may have been acquired without authorisation on or about June 6, 2023. We then engaged a third-party vendor to conduct a comprehensive review of the affected data to determine whether personal information may have been involved,” the care home provider said.

 

“After a thorough review of the impacted data, on April 9, 2024, it was determined that some of your personal information was present in the impacted data set,” it added.

 

Kisco said the compromised data included names and other personal identifiers along with Social Security Numbers. The company’s filing with the Maine state regulator also revealed that at least 26,663 individuals were impacted by the data security incident.

 

Kisco says it has “implemented additional measures” to reduce the risk of a similar incident occurring in the future. “We also notified the Federal Bureau of Investigation and will provide whatever cooperation may be necessary to hold the perpetrators accountable,” it adds.

 

Kisco Senior Living is offering complimentary credit monitoring and identity theft protection services and $1 million fraud insurance policy through IDX to all the individuals affected by the data breach.

 

On June 16, the BlackByte ransomware group claimed responsibility for the cyber attack on Kisco and listed the organisation as a victim on its data leak site. The hacker group also leaked samples of the stolen data, including confidential company documents, as proof of its success.