Hackers stole personal data of over 800k Sutter Health patients in California data breach
Hundreds of thousands of Sutter Health patients are learning that they had personal information stolen as part of the same massive data breach last May that hit roughly 1.2 million CalPERS and CalSTRS retirees and more than 70 million people worldwide.
Sacramento-based Sutter said it had contracted with a Virgin Pulse subsidiary called Welltok to store, organize and track patient information, ensuring that the health care giant could provide notices and communications relevant to each patient’s needs.
Virgin Pulse initially notified Sutter Health on Sept. 22 that it had been affected by the ransomware attack that targeted the MoveIt file transfer tool that supports the exchange of data between servers, systems and applications. Sutter said the final Virgin Pulse report, which explained the extent of the intrusion, arrived on Oct. 24.
“Based on the findings of Virgin Pulse’s investigation, it is estimated the personal information of approximately 845,441 Sutter Health patients may be impacted,” Sutter reported in a Nov. 3 announcement on its website. “Importantly, Virgin Pulse can confirm social security numbers and financial information were not impacted by this incident.”
While financial data were not lost, Virgin Pulse noted in a timeline on its website that “certain health information such as a provider name, prescription name, or treatment code may have been included.”
Threat analyst Brett Callow of the cybersecurity firm Emsisoft said one of the lessons here is that people shouldn’t think they were not affected by the MoveIt data breach simply because they haven’t received word that their personal information was compromised.
“The state of Maine, yesterday I think, disclosed that pretty much everyone in the state had been affected by this,” Callow said Friday. “I don’t know quite why it’s taking so long, possibly simply because of the really unprecedented scale of this breach.”
List of MoveIt breaches grows
Welltok, in the letter sent to Sutter patients, said it had installed all published patches and security upgrades for the MoveIt transfer software, so after receiving an alert on July 26, its cybersecurity experts examined whether its system was vulnerable to the attack.
They didn’t find any compromise at that time but hired an outside cybersecurity team to check for vulnerabilities, the company stated, and using new information that had become available, they detected a site on Aug. 11 where the system had been breached.
“We subsequently undertook an exhaustive and detailed reconstruction and review of the data stored on the server at the time of this incident to understand the contents of that data and to whom that data relates,” Welltok wrote.
The Welltok data breach and hundreds of others stem from May attacks by a ransomware group known as Clop or C10p. These hackers discovered a flaw or vulnerability in the MoveIt software and punched through it, gaining access and foiling encryption protocols.
By Emsisoft’s count, 2,590 organizations have reported being victims of the hack. So far, Callow said, none of the personal information has been leaked or abused.
“There is always the potential for that to happen, of course,” Callow said, “and people should be aware of that and be cautious.”
Sutter said that Virgin Pulse had notified all affected patients with letters that explained available services, resources and recommendations for patients to monitor any potential inappropriate use of their personal information. If impacted patients have further questions, they also can call Virgin Pulse at 800-628-2141 from 6 a.m. to 8 p.m. weekdays or 8 a.m. to 5 p.m. on Saturday and Sunday. The line is not staffed on major U.S. holidays.
Other health systems affected
The MoveIt data breach affected dozens of health care systems and hospitals, including Duke University Health System, UT Southwestern Medical Center in Texas and Johns Hopkins All Children’s Hospital in Maryland.
While lawsuits have alleged that hackers could store and use the stolen consumer information years in the future, Callow said that it would be difficult to find on the dark web and even tougher to access.
“Think of the amount of forensic work that companies needed to to do work out what was taken,” he said. “It would be a similar task to try and get that data organized in some type of usable form.”
It’s unknown whether these breaches violate privacy laws in the health care industry or other consumer confidentiality laws. Lawyers, including firms representing CalPERS retirees, have filed more than 100 suits against MoveIt developer Progress Software and other organizations.
Last month, over the objection of plaintiffs’ lawyers, a multidistrict judicial panel assigned U.S. District Judge Allison Burroughs in the District of Massachusetts to oversee all the litigation. Progress Software is based in Burlington, Massachusetts.
