Data breach exposes 58K patient health records

Healthcare data breach concept — By Shutterstock

Cyberattackers have breached Synergy healthcare company in the US, accessing thousands of private healthcare records along with other personal information.

Synergy, headquartered in Atlanta, Georgia, was forced to make the admission to the Maine Attorney General’s office on July 31st, after detecting the breach of its systems in December. The state of Maine imposes strict reporting requirements on organizations who suffer cyberattacks affecting any of its residents.

In this case, just four Maine residents were compromised, but the overall tally of victims across the US comes to more than 58,000.

“We determined that some of the affected files contained protected health information and other personally identifiable information,” Synergy said in a letter of notification sent to affected parties on July 27th.

Affected files may have contained patients’ names, birthdates, signatures, insurance policy and personal contact details, driver’s license or Social Security numbers, medical history, and financial information including bank account numbers.

“At this time, we have no reason to suspect that any of the affected information has been used fraudulently,” Synergy added — though, of course, that will be of scant comfort to victims, as cybercriminals often steal personally identifying information to sell to other parties on the dark web, who then use it to commit crimes such as identity impersonation and fraud.

Synergy explained that it first detected an intruder in its computer systems on December 15th, around two weeks after it believes it was initially breached. The healthcare provider then hired a cybersecurity outfit to investigate, and its findings were finalized on May 16th.

It is not clear why Synergy then waited for another two months before going public with the disclosure.

Synergy has offered victims one year’s worth of free credit monitoring by way of compensation.