It’s the second largest ransomware-related data breach in the healthcare industry that has ever been reported to federal regulators. Women’s Health Care Group of Pennsylvania (WHCGPA) reported on its website and to those very regulators that 300,000 of its patients were victims. While they aren’t sure exactly how long the intruders were perusing the network, they suspect it was all the way back to January when they gained access and retrieved what WHCGPA is calling “limited” information.
The amount of information did not include any financial data as far as the forensic analysts could tell. It did, however contain patient names, addresses, dates of birth, social security numbers, lab results, medical record numbers, blood types, race, and other information; enough for someone to commit healthcare fraud or identity theft, in any case.
The statement regarding this breach was issued on July 18. The investigators of the incident believe that a server and a workstation were infected by a “virus that was designed to block access to system files.” It was not specifically detailed out how the malware made it onto the system, but it could very well have been due to someone clicking a link or attachment in an email that carried the suspect virus.
It is important to note that malware sometimes hides in the background for days, weeks, or even years before making an appearance. It depends largely on the type of malware. Some wait for a particular file to be opened and others wait for certain websites to be visited. There are many other actions that could take place before malware shows itself and depending on what the author is trying to achieve, it may be years before the objective is met; all the while the malware lurking in the background.
Even though you may not immediately notice something happening if you open an infected file that arrives in email, it doesn’t mean nothing is happening or won’t ever happen. Always stay on top of email sent by unknown senders, that are a surprise to you, or seem out of place or unusual. Beware of clicking on attachments or links in these and any email. Although it may seem like you know the sender, phishers are getting much better at tricking readers.
Because the company did have recent backups of company data, it was restored and no ransom paid.
Credit monitoring for one year is being offered to those affected and it’s recommended that if you’re in that category you take advantage of it. Even though these services won’t fully protect you or prevent identity theft, they do provide value. They will notify you if an inquiry to your credit did occur and provide other assistance depending on the company. Contact WHCGPA’s website for more information on this.
However, it is still up to each and every person to be in charge of his or her own credit and take proactive action. This means ordering a copy of your credit report from each of the three major bureaus every year. Review them and report any anomalies or suspicious activity to the bureau that issued the report and get it corrected. While there are often mistakes on these reports, many times they are fraudulent and if something is amiss, you can take care of it right away if you’re checking your reports often.
These are available to you at no charge too. The site backed by the federal government is annualcreditreport.com. You must order each one separately, but that is actually to your benefit. This allows you to stagger when you order them. If you look at one every four months rather than looking at all of them once a year, you will notice potential fraud sooner and hopefully can deal with it when it’s less damaging.
For banks and credit unions
Share this article with your members
Copy a ready-made summary and link for your newsletter, website or social posts.
