Hackers leak medical reports after huge breach impacts 1.2 million patient records

• SimonMed Imaging lost sensitive data on 1.2 million people in a ransomware attack
• Medusa claimed responsibility, demanding $1 million to delete 212GB of stolen patient data
• Victims are offered free identity theft and credit monitoring

SimonMed Imaging, a large US outpatient medical imaging and radiology provider, suffered a cyberattack and lost sensitive data on more than a million people.

Earlier this week, the company filed a new report with the Office of the Maine Attorney General, in which it also shared a sample of the data breach notification letter it’s been sending out to affected customers. In it, it said that in late January, one of its vendors notified it of an ongoing security incident.

The following day, SimonMed discovered “suspicious activity” on its own network, and tried to thwart the attack by resetting password, setting up two-factor authentication (2FA), implementing endpoint detection and response monitoring, and removing all third-party vendor direct access to its systems.

Concrete action

But, by the time this was done, it was already too late. Between January 21 and February 5, cybercriminals exfiltrated sensitive data on 1.2 million people, SimonMed said. It only said the criminals stole people’s names and other “data elements”.

At the same time, ransomware^[1] operators Medusa claimed responsibility for the attack, stated they nabbed 212GB of various data, including ID scans, spreadsheets with patient details, payment details, account balances, medical reports, and even raw scans, BleepingComputer reported.

The publication also said that the attackers demanded $1 million to delete the data, and $10,000 to extend the deadline for publishing by one day.

Now, the company has been pulled from the data leak site, which would suggest that SimonMed Imaging paid the ransom demand. This has not yet been confirmed (nor denied), and it doesn’t necessarily mean the organization paid the whole sum.

Relevant authorities were notified of the incident, and third-party cybersecurity experts were brought in to assess the damage and help with the post-mortem. At the same time, the victims are being offered free identity theft^[2] and credit monitoring services through Experian.

Via BleepingComputer^[3]

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!^[4][5]

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.^[6][7]

You might also like