Details have emerged of an extraordinary data breach incident in which a US medical practice had thousands patient records and emails encrypted by attackers who then demanded a ransom to unscramble the data.
The incident appears to have come to light after a security blogger ‘Dissent Doe’ noticed a data breach report made by Illinois-based The Surgeons of Lake County medical centre to the US Department of Health and Human Services.
According to a small newswire that reported events, attackers were able to compromise one of the medical centre’s servers, encrypting its contents including 7,067 patient records and a quantity of emails.
The first the centre knew about the attack was on 25 June when a ransom note for an undisclosed sum was posted on the server, at which point it was turned off.
It is not clear whether the data was recovered through backups but the organisations reported the incident to the police and Department of Health.
“Safeguarding every patient’s personal information is a top priority at The Surgeons of Lake County. We are devoting significant people and technological resources to help protect patient confidentiality," the centre’s president Dr Scott Otto said in an official statement at the time.
What marks the compromise out from almost every data breach attack recorded is that the attackers opted to extort the victim organisation rather than attempting to sell or exploit the data itself.
It remains unlikely that the intention was to abuse this data directly; having occurred only days before the extortion note was received, the criminals would normally want a longer period to execute data and identity theft crimes. Most data theft criminals attempt to go undetected for this reason.
The criminals will, nevertheless, had access to sensitive data including names, addresses, social security and credit cards numbers plus medical records, prompting the centre to inform its affected patents of the breach.
“This is a warning bell. Maybe they’re the canary in the coal mine that unpredictable things can happen to data once it’s digitized,” said Santa Clara University law school professor, Dorothy Glancy, quoted by Bloomberg.