Atrium & Interim HealthCare Data Breaches Affect Millions

Event Summary

Two significant cybersecurity incidents have rocked the healthcare sector, placing the sensitive data of millions of patients at risk. Atrium Health, a leading U.S. healthcare provider, and Interim HealthCare, a home healthcare service, have reported data breaches stemming from security failures at their business associates. While these events were not direct attacks on the organizations' own systems, they painfully illustrate the critical importance of supply chain security and how the weakest link in a chain can jeopardize the entire system. Although each breach occurred at different times and through different methods, the outcome was similarly damaging: the unauthorized exposure of patients' personal and medical information.

The breach affecting Atrium Health originated from a vulnerability at a service provider used by its business associate, AccuDoc Solutions, which handles billing services. A third-party printing and mailing vendor used by AccuDoc was impacted by a critical vulnerability in the popular file transfer software, MOVEit Transfer, allowing attackers to access files belonging to Atrium Health patients. This led to a massive leak affecting 2.65 million individuals. In the case of Interim HealthCare, the breach was caused by a phishing attack on an employee of their payroll and billing partner, bizmarts, resulting in the exposure of data from nearly 5,000 patients. These two incidents demonstrate that internal security is not enough to protect health data; the security standards of business partners and their subsequent vendors must be rigorously audited.

Exposed Data and Scope of Impact

The types of information compromised in these data breaches pose serious risks to the victims. Different data sets were exposed in each incident, and the number of affected individuals varies significantly.

Atrium Health Breach (2.65 million individuals affected):

• Patient Full Names: Basic information for identity verification.
• Account or Guarantor Numbers: Unique identifiers related to financial and administrative records.
• Dates of Service: Information indicating when a patient received medical services.
• Amounts Owed: Financial obligations of the patient to the healthcare provider.
• Social Security Numbers (SSNs): Although stated to have been exposed for only a small subset, this is one of the most critical data types for identity theft.

Interim HealthCare Breach (approximately 4,961 individuals affected):

• Full Names: Basic identifying information.
• Address Information: Residential details.
• Social Security Numbers (SSNs): High-risk data for identity theft and fraud.
• Health Insurance Information: Details such as policy numbers and insurance carriers.
• Medical Diagnosis and Treatment Information: Extremely sensitive and private information about a patient's health status (Protected Health Information - PHI).

As is evident, the data types exposed in the Interim HealthCare case are more sensitive and directly violate medical privacy, while the Atrium Health case is alarming due to the sheer volume of people affected. In both scenarios, the compromised data can be used for fraud, identity theft, and targeted phishing attacks.

The Technical Details of the Breaches

The technical underpinnings of these two breaches represent two different facets of modern cyberattacks: exploiting software vulnerabilities and targeting the human element.

Atrium Health (MOVEit Vulnerability): The root cause of this breach is a method known as a "supply chain attack." The attackers did not target Atrium Health directly but rather a company that provides services to its business associate, AccuDoc. This company used a file transfer software called MOVEit Transfer, which had a critical vulnerability that was well-known and actively exploited by cybercriminals. This flaw allowed attackers to gain unauthorized access to servers and download the files stored on them. This method, used by ransomware gangs like Clop against hundreds of organizations worldwide, is proof of how a single software vulnerability can have a widespread impact. Attackers exploited this vulnerability to gain access to files containing the billing information of Atrium Health patients. This underscores the importance for organizations to secure not just their own systems, but their entire digital supply chain.

Interim HealthCare (Phishing Attack): This case relies on a more classic yet still highly effective method: phishing. Attackers sent a fraudulent email, disguised as if it were from a legitimate source, to an employee of Interim HealthCare's business associate, bizmarts. The email tricked the employee into visiting a fake website and entering their email login credentials (username and password). With these credentials, the attackers gained access to the employee's email account and were able to exfiltrate files and communications containing sensitive information belonging to Interim HealthCare patients. Phishing is an attack vector that demonstrates that the weakest link in cybersecurity is often human. No matter how strong technical protection mechanisms are, a single employee's lack of caution or training can create a breach that bypasses all defensive lines.

Who is Affected by These Breaches?

Those affected by these data breaches are patients who have directly received services from Atrium Health and Interim HealthCare of Lubbock and Amarillo. Patients may not have a direct relationship with intermediary companies like AccuDoc Solutions or bizmarts. However, it is important for them to know that when they receive healthcare services, their data may be shared with such business associates for billing, insurance processing, or other administrative purposes. Therefore, anyone who has received services from these healthcare organizations in the past is potentially at risk. The risk for Atrium Health patients covers 2.65 million people, while for Interim HealthCare patients, the number is around 5,000. Both organizations are sending notification letters directly to affected individuals to explain the situation.

What Should Affected Individuals Do?

If you believe you have been affected by these breaches or have received a notification letter, there are several important steps you should take to protect your data:

• Activate Credit Monitoring Services: In such cases, healthcare organizations often offer free credit monitoring and identity theft protection services to victims. Be sure to activate this service by following the instructions in the letter you receive. These services will notify you of suspicious activities, such as a new credit account being opened in your name.
• Review Your Credit Reports: Regularly request copies of your credit reports from the three major credit bureaus (Equifax, Experian, TransUnion) and check for any accounts or inquiries you do not recognize.
• Place a Fraud Alert or Credit Freeze: You can place a "fraud alert" on your credit reports, which requires lenders to take extra steps to verify your identity before issuing new credit. For a stronger measure, consider a "credit freeze." A credit freeze prevents new credit accounts from being opened in your name until you lift it.
• Be Wary of Suspicious Communications: Cybercriminals may use the leaked information to craft highly convincing phishing emails or phone calls. Do not trust anyone who contacts you referencing this breach and asks for additional information or for you to click a link.
• Review Your Account Passwords: Although no password leaks were reported in these breaches, it is always a good practice to change the passwords for your important online accounts to strong, unique ones as a general precaution.

Official Statements and Company Response

Both Atrium Health and Interim HealthCare have reported the breaches to the public and to relevant regulatory bodies, such as the U.S. Department of Health and Human Services' Office for Civil Rights. In their official statements, they emphasized that the incidents occurred on the systems of their business associates. Both organizations stated that they have begun sending notification letters to affected patients and are offering complimentary credit monitoring services to help victims protect themselves against identity theft. They also mentioned that they are reviewing their security protocols and contracts with their business associates to prevent similar incidents in the future. These statements aim to fulfill legal obligations and ensure transparency with the public.

Source

https://www.hipaajournal.com/atrium-health-interim-healthcare-lubbock-amarillo-data-breaches/