Georgia Hospital, Nursing Home Notifying 120,000 of Hack

A small rural Georgia hospital and its nursing home are notifying more than 120,000 patients that their sensitive information was accessed and acquired by hackers in a cybersecurity incident last fall. Ransomware gang Embargo claims on its dark web site to have published 1.15 terabytes of the stolen data.

See Also: OnDemand | Strengthen Cybersecurity with a Multi-Layered 3-2-1-0 Data Protection Strategy

In addition to typical types of stolen data such as names and Social Security numbers, Embargo’s dark website includes images of driver’s licenses, including individual headshot photos, driver license number, and physical traits, such as eye color and height, based on a review by Information Security Media Group.

Memorial Hospital and Manor, an 80-bed community hospital and 107-bed long-term care facility, in a report and sample breach notice filed Friday to the Maine attorney general said information, did not mention driver’s licenses, but said the November incident may have included patient name, Social Security number, date of birth, health insurance information, medical treatment and history information.

Memorial Hospital and Manor, which also operates Willow Ridge, a 22-bed personal care facility, are owned and operated by the Hospital Authority of the City of Bainbridge and Decatur County. In its breach notice, the hospital said it became aware on Nov. 2, 2024 of unusual activity that disrupted access to some computer systems. After discovering the incident, Memorial Hospital and Manor said its took steps to secure its network and engaged an independent cybersecurity firm to investigate.

“We also reported the incident to the FBI and will cooperate with any resulting investigation,” Memorial Hospital and Manor said. “In addition, we have implemented several measures to enhance our security posture and reduce the risk of similar future incidents.”

The Embargo cybercriminal group, a relative newcomer to the ransomware scene, also has posted on its darkweb site listings of data allegedly stolen from several other victims last year in the healthcare sector and other industries. That includes a pharmacy collaborative, a children’s playground equipment maker, and local police department (see: Embargo Ransomware Gang Sets Deadline to Leak Hospital Data).

As of Monday, several class action law firms, including Markovits, Stock & DeMarco, LLC had issued public notices saying they are investigating the Memorial Hospital and Manor incident for potential litigation.

Memorial Hospital and Manor did not immediately respond to ISMG’s request for comment on Embargo’s claims and for additional details about the incident.

Other Large Hacks

Certainly, Memorial Hospital and Manor is also not the only regional healthcare organization recently reporting major hacking breaches to regulators.

Asheville Eye Associates, which operates 10 eye care centers in western North Carolina, told the U.S. Department of Health and Human Services’ Office for Civil Rights on Jan. 17 that it was notifying more than 193,000 patients that their protected health information was potentially compromised in a recent hacking incident.

AEA in a breach notice posted on its website on Jan. 31 said an investigation into the incident to examining whether data was accessed or acquired determined that name, address, health insurance information and medical treatment information was exposed for a subset of AEA patients. Patient Social Security numbers, credit card numbers and financial information were not exposed as a result of this incident, AEA said.

“While the investigation has not identified any instances of fraud or identity theft that have occurred as a result of this incident, AEA recommends that individuals review any statements they receive from their healthcare providers or health insurers to ensure their accuracy,” AEA’s breach notice said.

AEA’s breach notice did not say when the eye care provider discovered the incident. AEA did not immediately respond to ISMG’s request for comments and for additional details about the incident including whether ransomware was involved.

But the largest breach reported so far this year was a hacking incident reported to federal and state regulators by Community Health Center, Inc., a nonprofit organization with healthcare practices located in medically underserved areas of Connecticut.

CHC is in the process of notifying nearly 1.1 million people – including pediatric patients and their parents and guardians – that their information was potentially stolen in a cyberattack detected earlier this month (see: Connecticut Health Clinic Hack Affects Nearly 1.1 Million).