Software Exploit Breach Affects Nearly 440,000

Ascension Health is notifying nearly 440,000 patients of a compromise involving a former business partner and the exploit of a third-party software vulnerability. The timing of the incident appears to line up with hundreds of Clop ransomware gang data thefts involving exploitation of a zero-day vulnerability in Cleo Communications’ managed file transfer software late last year, some experts said.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

The Ascension breach is also among several data security incidents the Missouri-based Catholic hospital chain has experienced in recent months involving other third parties (see: Ascension Notifying Patients About a Rash of Third-Party Hacks).

Ascension reported the breach to the U.S. Department of Health and Human Services on April 28 as a hacking incident involving a network server affecting 437,329 people. But despite Ascension’s breach notice stating the incident involved a “former business partner” and its use of an unspecified third-party software product, Ascension did not report the breach to HHS’ Office for Civil Rights as involving a HIPAA business associate.

Breach Details

Ascension in its April 28 notice about the breach said that on Dec. 5, 2024, it learned that its patient information may have been involved in a potential security incident.

“Our investigation determined on Jan. 21, that Ascension inadvertently disclosed information to a former business partner, and some of this information was likely stolen from them due to a vulnerability in third-party software used by the former business partner,” Ascension said.

“We have since reviewed our processes and are working to implement enhanced measures to prevent similar incidents from occurring in the future.”

Information potentially affected in the incident includes name, address, phone number, email address, date of birth, race, gender and Social Security number. Clinical information involving inpatient visits, such as place of service, physician name, admission and discharge dates, diagnosis and billing codes, medical record number and insurance company name, was also potentially compromised for some individuals, Ascension said.

Cleo Software Hack?

Some industry experts contend that the timing of the software incident at Ascension’s former business partner coincides with the timeline of cybercrime group Clop data thefts involving exploitation of a zero-day vulnerability in Cleo managed file transfer software (see: Clop Ransomware Takes Responsibility for Cleo Mass Exploits).

As of the end of February, the number of Clop victims experiencing Cleo exploitation incidents had risen to 400, said security firm BlackKite in a new ransomware research report issued Tuesday.

Ascension did not immediately respond to Information Security Media Group’s request for additional details about the breach, including the type of former business partner at the center of the incident and whether an exploit of a Cleo MTF software vulnerability was involved.

If Ascension does confirm its breach involved an exploitation of Cleo MFT software, “this attack mirrors their MOVEit attacks, showing how a single software flaw can impact dozens of organizations,” Agnidipta Sarkar said, a vice president of CISO advisory at security firm ColorTokens.

“This underscores the need for healthcare entities to implement zero trust mechanisms to protect their own data, stricter vendor oversight, robust data retention policies and swifter breach management and disclosure to protect patient data in an interconnected ecosystem,” he said.

Complex Third-Party Risks

Other security experts said that rash of several other recent incidents involving Ascension patient data underscores the importance of healthcare sector entities and their vendors carefully assessing and addressing their third-party risk.

“Having a strong third-party risk management program is critical in the current software-as-a-service first business model,” Chris Henderson said, CISO at security firm Huntress. “Third-party risk management doesn’t stop at assessing the vendor prior to procurement but requires a holistic approach to the life cycle of the vendor or contractor,” he said.

“Mature third-party risk programs will assess risk during procurement based on the criticality of the data the vendor will have access to, both the data inside your organization and the data you will store with them,” he said. “The data being shared should regularly be reviewed to ensure the initially assessed risk remains accurate.”

Thomas Richards, infrastructure security practice director at applications security firm Black Duck, said that it’s vital that entities not only understand their your own software supply chain, but also those critical business partners.

“As organizations improve their security posture, attackers will find ways to compromise easy targets who have not made the proper investment and policy changes,” he said. “I think we’re going to see organizations scrutinizing their partner’s security more before allowing them access to their systems or to handle sensitive information.”