Healthcare System Notifies 180,000 People 1 Year After Hack

A Georgia healthcare system is notifying more than 180,000 individuals of a data compromise involving a hacking incident first detected a year ago. The apparent Hive ransomware attack involved hackers accessing and copying files containing patient information, including medical and banking account information.

See Also: Live Webinar | Unmasking Pegasus: Understand the Threat & Strengthen Your Digital Defense

The delayed notification spotlights the range of growing breach response and notification challenges some organizations face, especially as increasing numbers of entities in the healthcare sector and other sectors become the victims of far-reaching data compromises by cybercriminals.

“It’s a case-by-case basis. Some delays are legitimate, and others are not,” said regulatory attorney Rachel Rose.

Tift Regional Health System said in a Friday data breach disclosure that a hacking incident had been detected on Aug. 16, 2022, and affected 180,142 individuals.

The Tifton, Georgia-based healthcare system first reported the hack to the U.S. Department of Health and Human Services’ Office for Civil Rights on Oct. 14, 2022, as affecting 500 individuals.

Because federal regulators require organizations to report HIPAA breaches affecting 500 or more individuals to HHS OCR within 60 days of discovery, some entities report those breaches with a placeholder estimate – typically 500 individuals – until cyber defenders can determine a more accurate count.

Tift Regional, which also goes by the name Southwell, is a not-for-profit healthcare system serving 12 counties in south central Georgia. The organization has about 135 physicians, several specialty care facilities and Tift Regional Medical Center, a 181-bed regional referral hospital located in Tifton, Georgia.

DataBreaches.net reported last September that the ransomware group Hive had claimed to have downloaded 1 terabyte of Tift data in a July 2022 attack and that negotiations between Hive and Tift had broken down.

Tift did not immediately respond to Information Security Media Group’s request for comment and for additional details about the incident, including why notification had been delayed and whether Hive had been involved.

Tift Breach Details

In an updated breach notice posted on its website on Aug. 7, Tift said that on or around Aug. 16, 2022, the organization had become aware of suspicious activity affecting certain systems within its network.

Tift said there had been no malicious encryption of its systems and the network had been available for staff to provide patient care. “The investigation determined that certain files on TRHS systems may have been accessed or copied without authorization between Aug. 11 and Aug. 17, 2022.

Tift said it conducted a review to determine the personal information contained in the affected files. The data potentially compromised includes certain individuals’ Social Security numbers, patient identification numbers, driver’s license numbers, medical information, treatment information, diagnosis information, health insurance information, financial account information, and birthdates.

Growing Difficulties

An assortment of factors could be related to why Tift’s breach notification lagged for one year.

“Hive was taken down by the FBI, and the announcement was made in January 2023,” Rose said. If Tift contacted the FBI about its attack, it is possible that the organization delayed notification in part due to federal law enforcement coordinating internationally to take down Hive, she said (see: Will Hive Stay Kaput After FBI Busts Infrastructure?).

There could also be other reasons for the delay, according to Rose. “It may legitimately depend upon the type and complexity of the attack. It could also be that an organization does not know where all of its data is located.”

Some experts also say the one-year interval between the detection of Tift’s incident and the identification of affected individuals is indicative of the scope of difficulties in breach response and notification that many other entities face.

There are challenges involving insufficient log records; lengthy, complicated and time-consuming reviews to determine the extent of information accessed or stolen; and a scarcity of available skilled professionals who can assist in conducting speedy reviews.

“One needs to correlate things like the amount of data that were seen being exfiltrated, the type of data in the source files, and the identity of the patient in each,” said Michael Hamilton, CISO and founder of security firm Critical Insight. Hospital records are dynamic, so it can be difficult to get an accurate count and identity list of the persons existing in records during the days or weeks when the incident occurred, he said.

Other issues, such as involvement of cyber insurers and the threat of possible class action litigation, could also affect breach response and notification processes.

“Data breaches are a hot area for lawsuits,” Rose said.

With so many organizations in and out of the healthcare sector experiencing hacking incidents and other breaches, waiting times to complete investigations are getting longer in some cases, Hamilton said.

“The length of these investigations is in part a function of the dearth of qualified forensic examiners. Incident response and forensic companies routinely partner because of just that – the demand for these individuals is clearly outstripping supply,” he said.

“In order to determine an accurate accounting of records that may have been accessed, it’s necessary to bring in forensic examiners to review logs and other evidence,” Hamilton said. “With a shortage of qualified practitioners, this may be a rate-limiting step.”

Legitimate forensic companies are responsive, Rose said. And while there may be delays, it is critical for counsel to work with the government agency to let them know the number of people identified and send notices out unless otherwise instructed. “It would also be prudent to let the public know that notices are coming to those who are impacted and may be issued in tranches as more information is learned,” she said.

Also, the headcount of affected individuals reported in breaches sometimes climbs in cases where the necessary log and other records are insufficient to determine exactly whose data and what information was compromised, Hamilton said.

In those cases, entities “must claim that everyone is affected,” he said.

Tift said in its breach notice that it is reviewing its existing cybersecurity policies and procedures and evaluating additional measures and safeguards to protect against this type of incident in the future.