NY Blood Center Says Data Was Stolen in Jan. Attack

New York Blood Center Enterprises said an undisclosed number of patients, employees and other individuals are potentially affected by a January cyberattack that compromised personal and health related information. The hack was among several in the last year involving blood organizations.

See Also: A Modern Approach to Data Security

In a report filed on Friday, the blood center told Maine’s attorney general that the incident affected eight residents of that state, but the nonprofit center did not indicate in that report how many patients were affected nationwide.

New York Blood Center describes itself as one of the largest community-based, nonprofit blood collection and distribution organizations in the U.S., providing supplies and services including blood and stem cell products, transfusion medicine and cellular therapies. It has provided blood-related services since 1964. The center did not immediately respond to Information Security Media Group’s request for an estimate on the total number of affected individuals.

In a prepared statement provided to ISMG, the center said that upon learning of the cyber incident, it took immediate steps to contain the threat and lessen disruption to critical services.

At the time of the incident, New York Blood Center said several operating divisions had been affected by the attack in collecting and distributing blood to hospitals in at least seven states, including New York, New Jersey, Connecticut, Delaware, Rhode Island, Nebraska and Missouri (see: NY Blood Center Attack Disrupts Suppliers in Several States).

“We have been working diligently with legal and forensic partners to investigate what happened,” the center said in its statement to ISMG on Monday. “We are operating as normal and all blood collection activities, donor center operations and community blood drives are continuing across our operating divisions.”

New York Blood Center said its forensics investigation into the incident determined that threat actors gained access to the organization’s network between Jan. 20 and Jan. 26, acquiring copies of a subset of the organization’s files. “Over the last several months we have reviewed the information impacted and we are now in the process of notifying relevant individuals pursuant to applicable laws,” the statement says.

The information contained in the affected files varied by individual but may have included names, limited health information and test results.

Some affected files also contained employment-related information including name, Social Security number, driver’s license or other government identification card number and financial account information if the individual participated in direct deposit.

Because New York Blood Center said it does not collect or maintain contact information for individuals it provides clinical services to, and “as a result, we are unable to mail letters to individuals whose information may have been involved,” the organization said.

The center is offering affected patients a year’s worth of complimentary credit and identity monitoring and also said it is implementing enhancements to information security, IT systems and monitoring capabilities.

The January ransomware attack was among several similar incidents involving blood suppliers in the United States and elsewhere over the past year. Those include an August 2024 ransomware attack on a Florida-based blood center OneBlood and an April 2024 attack on Octapharma Plasma, the U.S. operations of a Swiss pharmaceutical maker, with each incident disrupting blood collection and processing operations for several weeks.

Outside the U.S., a June 2024 ransomware attack on Synnovis, a British pathology laboratory services provider, disrupted patient care and testing services at a number of London-based National Health System hospitals and other care facilities for several weeks.

That incident ultimately caused the postponement and cancellation of thousands of procedures and appointments and triggered a nationwide shortage of type-O blood supplies in the U.K. The NHS also attributed the delay of care services caused by the disruption as a factor contributing to at least one patient’s death (see: Breach Roundup: UK NHS Links Patient Death to Ransomware Attack).