Victim Count in Maryland Ransomware Breach Jumps Fivefold

A Berlin, Maryland-based hospital recently told regulators that a ransomware breach discovered in January had compromised the sensitive information of nearly 137,000 patients, about five times the number of people originally estimated as having been affected by the incident.

See Also: OnDemand Webinar | Learn Why CISOs Are Embracing These Top ASM Use Cases Now

Atlantic General Hospital provided the updated breach tally in a report submitted to Maine’s attorney general on Friday, which supplemented a March 24 filing estimating that about 30,700 people – including three Maine residents – had been affected by the ransomware incident.

The hospital now said that 32 Maine residents are among the total 136,981 individuals affected.

Some experts say the significant increase in the number of individuals illustrates the breach analysis challenges that many organizations encounter in the aftermath of a ransomware or other hacking incident.

“Obtaining an accurate count of affected individuals and determining the type of compromised data in the aftermath of ransomware incidents can be time-consuming due to the need for thorough forensic investigations, extensive data analysis, and the complexity of healthcare systems, which often involve numerous interconnected databases and sources of information,” said Jon Moore, chief risk officer at privacy and security consultancy Clearwater.

Organizations often face regulatory deadlines to report before they have a final forensic report, he added. For instance, under HIPAA, covered entities must report to federal regulators breaches of protected health information affecting 500 or more individuals within 60 days of discovery.

Atlantic General did not immediately respond to Information Security Media Group’s request for additional details about the incident, including whether any data had been exfiltrated and why the tally of affected individuals climbed so sharply over the last three months.

Not-for-profit Atlantic General Hospital is part of Atlantic General Health System, which also includes 40 family physicians, internists and specialists with offices in 17 locations throughout Maryland, Virginia and Delaware.

Breach Details

In its breach notice, Atlantic General said it had discovered on Jan. 29 that files on certain systems had been encrypted.

In the days following that discovery, Atlantic General temporarily closed its outpatient imaging services, walk-in lab services and its pharmacy as it recovered from the incident.

Atlantic General’s forensics investigation determined that unauthorized access to certain servers began on Jan. 20, the entity said. On May 15, the hospital completed its review, finding that information for additional individuals potentially had been affected.

Among the information subject to unauthorized access was each individual’s name, Social Security number, driver’s license number, financial account information, birthdate, medical record number, treating/referring physician, health insurance information, subscriber number, medical history information, and diagnosis/treatment information, the hospital said.

“Several elements can impact the ability of a forensic investigator to determine the size and extent of a breach,” Moore said. “These include the sophistication of the attacker and how well they have covered their tracks, the level of complexity within the targeted environment, and the information available for analysis.”

For example, for organizations with poor logging controls, “it will be very difficult, if not impossible, for a forensic investigator to say with certainty where the attacker went in the environment and what was accessed.”

Atlantic General faces at least one proposed class action lawsuit related to the breach so far. That lawsuit, filed in a Maryland federal court on April 13 by plaintiff Michael Rentschler, on behalf of himself and all others similarly situated, accuses the healthcare entity of negligence, breach of implied contract, violations of a variety of state laws, and an array of other allegations.

The lawsuit complaint, which alleges that the plaintiff and class members face increased risk of identity theft and fraud crimes and other harm as a result of the breach, seeks statutory and punitive damages, as well as injunctive relief ordering Atlantic General to improve its data security practices.

“It’s worth noting that legal requirements for individuals to sue organizations vary by state, with some jurisdictions necessitating demonstrable harm as a prerequisite for legal action, while others may not impose this requirement,” Moore said.