Threat Actors Accessed, Stole Data for About 2 Months; BianLian Claims Credit
A health system in rural Michigan is notifying nearly 140,000 people that their information was potentially compromised in a data theft incident occurring between November 2024 and January 2025. Cybercriminal gang BianLian lists Aspire Rural Health System as a victim on its dark website.
See Also: Post-Quantum Cryptography – A Fundamental Pillar in the Future of Cybersecurity [ES]
In a breach report submitted Thursday to Maine’s attorney general, Marlette, Mich.-based Aspire said the external system hacking incident affected 138,386 people.
Aspire on its website describes itself as “a family of 70-plus providers in Huron County, Sanilac County, Tuscola County and Lapeer County, working together to expand accessibility to quality rural healthcare.”
A breach notice posted on its website said Aspire learned that “an unauthorized party” accessed Aspire’s internal network on or about Nov. 4, 2024, through around Jan. 6. The notice does not say when Aspire made this discovery.
“Upon detecting the unauthorized activity, Aspire immediately worked to contain the incident and launched a thorough investigation,” the notice said.
Aspire said it engaged outside cybersecurity professionals to secure its IT environment and identify the scope of what personal information was affected.
After “an extensive forensic investigation and manual document review exercise,” Aspire determined around July 18, that some files and folders accessed or acquired by the threat actors contained personally identifiable information and protected health information.
That information included names, dates of birth, Social Security numbers, financial account numbers and routing numbers, medical treatment and diagnosis information, prescription information, individual health insurance information, payment card numbers and access PIN numbers, payment card expiration dates, lab results and provider information.
Also affected are driver’s license numbers, password and usernames, biometric identifiers, patient identification numbers, medical record numbers and passport numbers. The information affected varies upon individuals, Aspire said.
“To date, Aspire has no evidence of financial fraud or identity theft directly related to this incident,” the notice said.
Ransomware group BianLian lists Aspire on its dark website as one of its approximately 553 victims. The gang claims its Aspire data trove includes financial, human resources, patient PHI and personally identifiable information, “partners’, vendors’ and providers’ private data,” mailboxes, including internal and external correspondence, and various databases.
Aspire did not immediately respond to Information Security Media Group’s request for comment and additional details about the hack.
As of Friday, the Aspire incident was not yet posted on the U.S. Department of Health and Human Services’ HIPAA Breach Reporting Tool website listing health data breaches affecting 500 or more individuals.
Rural Cyber Challenges
Some experts said rural healthcare providers like Aspire often face a plethora of cybersecurity obstacles that can hamper prevention, detection and response to security incidents.
“With already limited budgets and lean staffing, cybersecurity often gets forced to compete with other urgent clinical and operational priorities,” said Jackie Mattingly, senior director of consulting at privacy and security consulting firm Clearwater.
“Many rural organizations rely on legacy systems and infrastructure, which can be harder to secure and less compatible with modern security tools,” said Mattingly, former long-time CISO of a rural healthcare system in Kentucky.
“A shortage of dedicated cybersecurity professionals adds to the challenge, leaving IT teams wearing many hats and often responsible for everything from keeping the lights on to trying to protect sensitive patient data,” she said.
Another critical gap is often the absence of 24/7 monitoring through a security operations center or a managed detection and response service, she said. “Without round-the-clock visibility, attackers have greater opportunity to move through networks undetected,” she said.
Rural providers often depend heavily on third-party vendors for electronic health records, billing and other core functions, which introduces additional risks when vendor security practices are weak, she said.
“Together, these realities leave rural community hospitals, who are already the backbone of care for so many families, at a real disadvantage compared to larger, urban counterparts with more mature resources and defenses,” Mattingly said. “This is what makes them such a vulnerable and attractive target for cybercriminals, and why it’s so important to advocate for stronger protections in these communities.”
As far as the apparent delay in Aspire detecting that unauthorized access to it systems had been ongoing for at least two months, unfortunately those kinds of lags are not too unusual, Mattingly said.
“According to IBM’s most recent healthcare analysis, breaches in the healthcare industry take on average 213 days to discover, compared to 194 days globally,” she said.
“Aspire’s case underscores the difficulty: Attackers maintained access from November 2024 to January 2025, revealing how limited resources can hinder timely detection and response – especially for healthcare organizations in rural areas.”