Anna Jaques Hospital has confirmed on its web site that a ransomware assault it suffered nearly exactly a yr in the past, on December 25, 2023, has uncovered delicate well being information for over 310,000 sufferers.
Anna Jaques is a not-for-profit group hospital in Massachusetts, acknowledged for delivering high-quality care and performing over 4,700 surgical procedures yearly.
As a mid-size acute hospital offering 83 beds, 200 physicians, and 1,200 employees members, AJH performs a vital position in Merrimack Valley, North Shore, and southern New Hampshire, offering important healthcare providers to the native inhabitants.
In 2023, at Christmas time, Anna Jaques discovered {that a} cyberattack had impacted particular techniques and took quick motion to comprise the harm by taking them offline and alerting legislation enforcement.
The healthcare group launched an investigation on January 24, 2024, a couple of days after the ‘Cash Message’ ransomware group started publicly extorting the hospital on January 19.
The risk actors leaked information samples allegedly stolen from Anna Jaques on their darkish internet extortion web site, threatening to show delicate affected person data if their calls for weren’t met.
Subsequent updates on the Cash Message web page confirmed that the hospital’s directors did not have interaction with the risk actors, and the state of affairs culminated with the discharge of all information on January 26.
Supply: BleepingComputer
Anna Jaques states that the forensic investigation into what the risk actors had stolen was thorough and prolonged, involving handbook doc assessment, so it was solely accomplished on November 5, 2024.
In line with the associated entry on the Workplace of the Maine Legal professional Common, the place Anna Jaques posted a pattern of the notification it despatched to affected people yesterday, the incident has impacted 316,342 sufferers.
In line with its outcomes, the next data has been uncovered:
- Demographic data
- Medical data
- Medical insurance data
- Social Safety quantity
- Driver’s license quantity
- Monetary data
- Different private or well being data supplied to Anna Jacques
“Anna Jaques has no indication that there was any fraud because of this incident,” reads the announcement.
“Nonetheless, out of an abundance of warning, commencing on December 5, 2024, Anna Jaques notified people whose data might have been impacted because of the incident to the extent Anna Jaques had their handle.”
“Moreover, Anna Jaques reminds its staff and sufferers to stay vigilant in reviewing monetary account statements frequently for any fraudulent exercise.”
These impacted are provided 24-month-long id safety and credit score monitoring providers by Experian and 1B and are urged to contemplate putting a fraud alert or safety freeze on their credit score file.