Ascension Notifying Patients About Rash of 3rd Party Hacks

Missouri-based Catholic hospital chain Ascension Health is apparently notifying hundreds of thousands of individuals across several states of at least four hacking incidents in recent months involving third-parties.

See Also: Enterprise Browser Supporting Healthcare, Cyber Resilience

Ascension – which operates 140 hospitals and 40 senior care facilities in 19 states plus the District of Columbia – reported one of the breaches this week, another in mid-April and posted public notices about the two incidents on organization’s website in March and February.

As of Thursday, half of the incidents had not yet been posted on the U.S. Department of Health and Human Services’ Office for Civil Rights’ HIPAA Breach Reporting Tool website listing health data breaches affecting 500 or more individuals.

Based on some of the breach reports Ascension filed to several state regulators, the incidents potentially affected hundreds of thousands of individuals.

On Tuesday, Ascension told Texas’ attorney general that nearly 116,000 residents of that state were among those affected by a data security incident the organization learned of on Dec. 4, 2024.

That incident, which affected patient information from Ascension locations in Alabama, Michigan, Indiana, Tennessee and Texas, involved Ascension inadvertently disclosing information to a former business partner – and that some of that information “was likely stolen from them due to a vulnerability in third-party software used by the former business partner,” the hospital chain said.

Ascension said in its notice that patient data from Ascension locations in those five states were involved. The organization has also filed breach reports for that same incident to a few attorneys general in other states, including Massachusetts, where Ascension does not operate any hospitals.

Ascension’s report to Massachusetts’ attorney general said that 96 residents of that state were affected.

Ascension did not publicly identify the former business partner inadvertently provided with patient information, nor did it specify the third-party software vulnerability exploited in the data theft. Ascension said the incident did not involve the organization’s systems, networks or electronic health records.

Besides that breach, Ascension on April 14 posted a notice pertaining to what appears to be a separate third-party security breach involving Missouri-based law firm Scharnhorst Ast Kennard Griffin, or SAKG. Like the other breach reported this week, Ascension said the SAKG incident did not compromise Ascension systems, networks or electronic health records.

Ascension said that on Aug. 1, 2024, SAKG became aware of suspicious activity within its environments. An investigation “determined that certain information was viewed or taken by an unauthorized actor between July 17, 2024 and Aug. 6, 2024. SAKG notified Ascension of impacted individuals on Feb. 14, 2025,” Ascension said.

Information compromised in that incident includes name, phone number, date of birth, date of death, Social Security number, driver’s license, race and medical treatment related information.

SAKG did not immediately respond to Information Security Media Group’s request for additional details about its hacking incident, including whether any other clients beyond Ascension were affected and the number of people whose data was potentially compromised.

Ascension on March 3 posted a notice on its website pertaining to a data security incident involving Access Telecare, a third-party business partner that provides telehealth services to Ascension Seton in Texas. This incident also did not involve Ascension systems, networks or EHRs, Ascension said.

HHS OCR’s website indicates that Texas-based Access Telecare reported the incident to the agency on March 8 as an email hack affecting nearly 62,700 individuals.

In addition to those incidents, on Feb. 14, Ascension said it received notice from Restorix Health, a third-party firm that provides wound care management services to certain Ascension hospitals. Like the other breaches, this incident also did not involve any Ascension systems, networks, or EHRs, the hospital chain said.

The HHS OCR website shows that Louisiana-based Restorix reported the breach on Feb. 14 as an unauthorized access/disclosure email incident affecting nearly 39,000 individuals.

Besides the breach reported to Texas’ attorney general this week, Ascension reported to that state regulator on Feb. 4 that nearly 153,781 residents were affected in a breach that compromised individuals’ Social Security number, driver’s license number, financial and medical information.

It is not clear which Ascension incident that the Feb. 4 breach report to the Texas’ attorney general involved.

Ascension did not immediately respond to ISMG’s request for details pertaining to the four breaches involving third-parties, including the number of people affected and for clarification on whether any of the incidents are related to each other.

Third-Party Risk

Third-parties are commonly being targeted for initial access, said Mike Hamilton, field CISO at security firm Lumifi Cyber.

Recent reports from Google Mandiant and Verizon “show an increase in incidents involving third-parties, as well as a focus on small to medium businesses. Both those signals are apparent in this case” involving Ascension’s recent breaches, he said.

The fact that four business associates disclosed patient records pertaining to Ascension “could be random, but the perception created is that there are concerted attempts being made to acquire Ascension patient data,” Hamilton said.

“However, it’s more believable that these smaller organizations were crimes of opportunity, as they are not likely to have the same resources to apply to organizational cybersecurity,” he said.

“The interesting question to ask is whether the tools, techniques and procedures used to compromise the third parties were similar – if so, suggesting a single criminal enterprise,” he said.

The recent rash of incidents involving Ascension third-party vendors come on the heels of Ascension reporting in December 2024 that nearly 5.6 million current and former patients and employees were affected by a highly disruptive May 2024 ransomware attack that also involved data theft (see: Ascension Notifying 5.6 Million Affected by Ransomware Hack).