Hacks on Specialty Health Entities Affect Nearly 900,000

Specialty healthcare providers know what they’re about when it comes to an irregular heartbeat or a wheezing lung. Cybersecurity, not so much – despite how hacks on specialty medical entities easily result in tens of thousands, if not hundreds of thousands, or even millions, of patient records being compromised.

See Also: Post-Quantum Cryptography – A Fundamental Pillar in the Future of Cybersecurity [ES]

Chances are a stand-alone gastroenterology practice is much better at diagnosing patients’ guts than probing its own IT infrastructure for weak spots. The reasons include low cybersecurity budgets – whether from ignorance or budget constraints – and perhaps a belief that it can’t happen to them.

Three recently reported breaches involving separate specialty medical care providers underscore the vast numbers of patients, and also sometimes employees, whose personal and health information are compromised in such hacks.

Incidents involving a New York orthopedic surgery group, a Florida operator of medical imaging centers and an Iowa home healthcare provider affected a total of nearly 900,000 individuals. They are also among a long and growing list of other medical specialty entities also hit with similar incidents over recent weeks, months and years.

“Specialty medical providers, like these organizations, often hold highly sensitive personal and health-related data and are incredibly valuable on the cybercriminal black markets,” said Errol Weiss, chief security officer at the Health Information Sharing and Analysis Center.

Cybercriminals exploit stolen data from specialty medical providers in several ways to perpetrate financial fraud, he said. “This makes specialty providers a lucrative target for ransomware and data theft campaigns. The data these providers handle – such as imaging results, orthopedic records, or homecare plans – adds another layer of risk,” he said.

This data is valuable for identity theft but can also be used for extortion, as seen in cases where attackers threaten to release sensitive medical information unless a ransom is paid.

On Friday, Amherst, NY-based Excelsior Orthopedics, LLC filed an updated breach report disclosing that a 2024 hack affected nearly 395,000 former and current patients and employees.

Excelsior first reported the incident to federal regulators in August 2024 as affecting nearly 293,000 individuals, but that victim tally has risen in recent months by about 100,000 people as the orthopedic care provider continues to analyze the affected data. Ransomware gang Monti in August 2024 listed Excelsior as a victim on its darkweb site.

Those affected in the hack includes current and former patients and employees of Excelsior and its related entities, including Buffalo Surgery Center and Northtowns Orthopaedics.

Miami, Florida-based Vital Imaging Medical Diagnostic Centers, which operates eight medical imaging and testing facilities in the region, also recently reported a hacking incident affecting hundreds of thousands of patients.

Vital Imaging reported to the U.S. Department of Health and Human Services on Aug. 21 that a hacking incident first detected on Feb. 13 has affected 260,000 individuals.

“At this stage in the investigation, it is too early to tell what specific information was involved. However, we believe that information affected by the incident may include medical information, insurance information and demographic information – for example, contact information, date of birth,” Vital Imaging said in its breach notice.

The University of Iowa Health Care on Friday also began notifying 211,000 individuals of a hacking incident involving an affiliate – the University of Iowa Community HomeCare – which provides full-service home infusion and medical equipment services to patients in Iowa, Western Illinois and Northern Missouri.

In a breach notice posted on its website Friday, the practice said its incident, affecting 211,000 people, involved the University of Iowa Community HomeCare, an affiliate.

“While UI Community HomeCare and UI Health Care have separate operating systems, electronic health record systems and information technology services, their relationship has historically involved sharing some patients, employees and data files,” UI Health Care said.

Potentially compromised data includes name, date of birth, address, phone number, medical provider, dates of service, health insurance information, Social Security number and type of visit.

The separate incidents reported by Excelsior, Vital Imaging and UI Health Care are among the latest batch of major hacking breaches also involving many other specialty healthcare services providers (see: Medical Specialty Groups: Why Cybercriminals Are After Them).

Other specialty medical providers that have experienced similar incidents – including data thefts and ransomware attacks – run the gamut, from cancer care centers, sleep clinics, plastic surgery practices and other entities that often handle especially sensitive patient records.

Many of these medial practices often lack deep, or even basic, cyber bench strength.

“Many specialty providers operate under severely constrained budgets and limited cybersecurity expertise. Smaller practices often lack the resources needed to implement adequate cybersecurity measures, leaving them exposed to opportunistic attacks,” Weiss said.

Unpatched software, misconfigured systems and legacy medical devices running unsupported operating systems create vulnerable environments. “Cybercriminals exploit these gaps, knowing that these organizations may not have the capacity to detect or respond to intrusions effectively,” he said.

The stakes are high, not just for the organizations themselves but for the patients who depend on their services. Specialty providers cannot afford prolonged downtime without jeopardizing patient care, Weiss said. “This urgency often forces them to pay ransoms quickly to restore operations, making them prime targets for ransomware groups.”