Breach Affecting 104,000 Underscores Health Data Risks for Non-Healthcare Firms
A hacking incident involving an Ohio-based hand tool manufacturer that sells its products through franchises has affected nearly 104,000 people, including their medical data. The breach serves as a cautionary tale about non-healthcare sector organizations and the risks they face in handling health information.
See Also: OnDemand | Transform API Security with Unmatched Discovery and Defense
Cornwell Quality Tools, a 106-year old maker of ratchets, sockets, wrenches, storage equipment and other gear, reported the hacking incident to several state regulators on Monday. That included the company telling Maine’s attorney general that the cybersecurity incident, discovered on Dec. 20, 2024, affected 103,782 people.
The information potentially compromised included name, Social Security Number, financial account number and medical information.
Cornwell distributes and sells its products through dealers, including truck-based franchises that deliver the tools to customers in the automotive and other heavy-duty repair industries that are not at all healthcare-sector related.
But like many non-healthcare sector businesses, Cornwell appears to handle health information potentially as part of its human resources operations, medical insurance coverage plans, or other functions that often can be vulnerable to hacking incidents or other types of compromises, some experts said.
“Even though Cornwell doesn’t appear to be a HIPAA-regulated entity at first glance, if Cornwell maintains an employer-sponsored health plan then, depending on the structure of the plan, the company’s plan could be considered a covered entity ‘health plan’ regulated by HIPAA,” said attorney Jordan Cohen, a partner at law firm Akerman.
Also, for a tool manufacturer and distributor such as Cornwell, the medical information maintained could involve a variety of activities, such as employee benefits administration, health benefits, health spending accounts, wellness programs, workers’ compensation, Family and Medical Leave Act, Occupational Safety and Health Administration regulations, or other administrative purposes, he said.
“Medical information bridges personal and professional life, so even non-healthcare companies are custodians of highly sensitive data,” said Jon Moore, chief risk officer at privacy and security consultancy Clearwater.
Non-healthcare sector organizations might also collect information involving drug testing or fitness-for-duty purposes, Moore said.
“In litigation or compliance contexts, sensitive medical details may be processed as well,” he said. Also, some organizations touch medical data indirectly – such as law firms, insurers and tech providers. “In short, medical data can flow into non-healthcare companies through multiple business functions,” he said.
‘Cautionary Tale’
Given the scale of the Cornwell incident – more than 100,000 individuals affected – “this likely represents a comprehensive HR database containing employee medical information collected through standard employment processes,” Cohen said.
“This breach serves as a cautionary tale for employers about the hidden medical data privacy and security risks in standard HR operations,” he said.
The Cornwell incident also underscores the importance of treating employee medical information with the same or similar security protections that a traditional covered entity or business associate is required to apply under HIPAA – especially since many employer health plans are subject to many of those same requirements, Cohen said.
Cornwell in its breach notification letter said that upon learning on Dec. 20, 2024, of “unusual activity” within its computer network, it immediately took steps to secure its systems and engaged cybersecurity experts in the process.
According to the investigation into the incident, an unknown actor gained access to Cornwell’s network and potentially acquired certain files on or around Dec. 12, 2024.
“Following a comprehensive review of the affected files, Cornwell determined that certain individuals’ personal information may have been involved in this incident,” the notification said.
Cybercriminal gang Cactus listed Cornwell as a victim on its dark website in February, claiming to have 4.6 terabytes of the company’s data.
An attorney handling Cornwell’s data breach notification did not immediately respond to Information Security Media Group’s request for additional details about the incident, including the type of medical information Cornwell maintains, and for comment on Cactus’ darkweb claims.
For any non-healthcare sector organizations handling health-related information of employees or others, Cohen suggests they take several critical steps to protect that data.
That includes treating medical information with “healthcare-level security regardless of HIPAA applicability,” he said. “Even if it’s not regulated as a health plan, employers still face increasingly strict state laws, not to mention a well-funded plaintiff bar,” he said.
Other measures include implementing rapid incident detection and response procedures; considering data segregation to limit breach scope; applying encryption and strict access controls to medical data repositories; conducting regular penetration testing and vulnerability assessments; and engaging regulatory counsel to pressure test compliance.
“The lesson is that if you touch employee or customer health data – even incidentally – you must treat it with the same rigor as financial or trade secret information,” Moore said. “Reputational and regulatory risks attach to mishandling this data, regardless of HIPAA applicability.”