Staten Island Hospital Notifying 674,000 of May 2023 Hack

Richmond University Medical Center, a 440-bed teaching hospital on Staten Island, N.Y, is notifying 674,000 people of a data theft that happened 18 months ago. The breach was part of a ransomware attack that disrupted the organization’s IT systems for several weeks in spring 2023.

See Also: Enterprise Browser Supporting Healthcare, Cyber Resilience

The center reported the data breach on Dec. 19, 2024, saying in a notice to federal regulators that third-party cybersecurity professionals helped respond to the incident and investigate the breach.

“Although the initial forensic investigation determined our electronic health records system was not affected by the incident, the investigation subsequently determined that certain other files may have been accessed or removed from our network on or around May 6, 2023,” RUMC said.

The hospital manually reviewed the affected files “to determine whether they contained any sensitive personal information or personal health information.”

RUMC’s review process determined that at least one of the compromised files contained patient information, including full names and one of more other identifiers. That includes Social Security numbers, dates of birth, driver’s license numbers or state identification numbers, other government identification numbers, financial account information, credit or debit card information, biometric information, user credentials, medical treatment and diagnosis information, and health insurance policy information.

The incident caused a widespread IT outage that disrupted connectivity and access to records at RUMC’s hospital and outpatient facilities for nearly a month, according to local media outlet Staten Island Live.

The center did not immediately respond to Information Security Media Group’s request for comment and additional details about the breach, including why it took more than 18 months to begin notifying individuals following the attack.

Many healthcare sector organizations struggle with incident response and end up with long lags between the discovery of a breach and notifying affected individuals, some experts said.

The HIPAA breach notification rule requires covered entities to notify affected individuals within 60 days of discovering a protected health information compromise and to also report such incidents affecting 500 or more people to federal regulators within that same timeframe.

“Many organizations lack the skills to determine the outcome of what occurred during a breach,” said Paul Underwood, vice president of security, Neovera, a managed provider of cloud and cybersecurity services.

“This lack of skills and budget for critical infrastructure organizations like hospitals leads to a slow process of determining what happened during a malicious event,” he said.

He added that insurance companies do not cover many of these costs, “so there is a lack of a budget to dig into what a malicious actor has done. Sometimes, they must spend weeks, months and even years digging through systems until they determine what a malicious actor may have touched.”

Healthcare organizations can take preemptive steps to help better respond to a data theft incident or other breach, so that affected individuals can be notified in a more timely way, other experts said.

“First, healthcare organizations should minimize the amount of data being stored, and second, isolate the truly sensitive information from easy access,” said Jeff Wichman director of incident response at security firm Semperis.

A “tiering model” of their infrastructure and data would allow them to isolate the most sensitive data, he recommended.

“In addition, healthcare organizations should build a robust Active Directory model to reduce the easy access that attackers are looking for when they attack,” he said. “And with 90% of ransomware attacks leading to identity system compromise, it is essential that organizations prioritize identity system security.”

In addition notifying patients, RUMC is already facing proposed federal class action litigation tied to the incident, including several lawsuits filed in recent weeks. The lawsuits – which all seek financial damages and make similar claims – allege RUMC was negligent in failing to safeguard individuals’ sensitive health and personal information.