Between July 14 and July 23, 2023 [2] [4], HealthEC LLC [1] [2] [3] [4] [5] [6], a healthcare tech firm based in New Jersey, experienced a significant data breach that compromised the personally identifiable information of individuals who received care through one of the company’s customers [1].
Description
The breach, which was discovered in July but not disclosed to clients until late October, affected approximately 4.5 million individuals [1] [6]. Unauthorized individuals gained access to some of HealthEC’s systems [1], allowing them to obtain sensitive information such as names, addresses [1] [2] [3] [4], dates of birth [1] [2] [3], Social Security numbers [1] [2] [3] [4] [5], medical record numbers [1] [2] [3] [4], health insurance information [1] [2] [3] [4], and billing and claims data [1] [2]. This breach impacted 17 healthcare providers in the US [2], including Corewell Health [2] [4], HonorHealth [2] [4], Beaumont ACO [4], State of Tennessee – Division of TennCare [4], the University Medical Center of Princeton Physicians’ Organization [4], and the Alliance for Integrated Care of New York [4]. MD Valuecare alone had 112,005 patients with stolen information [4]. HealthEC has taken immediate action to secure their network [1], notified affected partners [1], and involved federal law enforcement [1]. There is currently no evidence to suggest that it was a ransomware attack [1], and no ransomware gang has claimed responsibility [1]. HealthEC advises individuals to remain vigilant against identity theft and fraud by monitoring account statements [1], explanation of benefits statements [1], and credit reports for suspicious activity [1]. The specific details of the exploit, attack vector [6], vulnerabilities [6], affected products [6], source country [6], target country [3] [6], and bad actors involved in the breach are not provided.
Conclusion
This data breach has had significant impacts on the affected individuals and healthcare providers. HealthEC has taken steps to secure their network and involve law enforcement, but the potential for identity theft and fraud remains a concern. Individuals are advised to monitor their accounts and credit reports for any suspicious activity. The lack of specific details about the breach makes it difficult to fully assess the situation and determine future implications. It is crucial for organizations to prioritize cybersecurity measures to prevent such breaches and protect sensitive information in the future.
References
[1] https://dailysecurityreview.com/security-spotlight/healthec-data-breach/
[2] https://www.tomsguide.com/news/yet-another-healthcare-data-breach-leaves-45-million-patients-personal-data-exposed-what-to-do-now
[3] https://www.jdsupra.com/legalnews/update-victim-count-in-healthec-data-3768523/
[4] https://www.techradar.com/pro/security/healthcare-firm-reveals-data-breach-affected-millions-of-patients
[5] https://www.itpro.com/security/healthec-incident-shows-healthcare-data-breaches-are-getting-out-of-control
[6] https://www.infosecurity-magazine.com/news/healthec-breach-millions-patients/
