5.6M people exposed in Ascension Health ransomware incident earlier this year

A cyberattack earlier this year is impacting 5,599,699 patients and employees of Ascension Health, one of the largest healthcare systems in the US. The exposed data is very sensitive and includes medical records, payments, insurance, identification, and other personal information.

Ascension, which operates around 140 hospitals and 40 senior care facilities, has about 175,000 associated providers across the nation, and handles over 16 million patient visits annually, suffered a devastating cybersecurity breach on February 29th, 2024, according to a filing with the Maine Attorney General’s Office.

The ransomware attack was first discovered on May 8th, 2024, and caused chaos in the hospitals, forcing them to utilize manual and paper-based systems.

The organization is now beginning the process of notifying affected individuals as the data review is completed.

The non-profit Catholic healthcare organization also disclosed that hackers obtained a vast amount of very sensitive information.

Although the data involved “varies and cannot be confirmed for each individual,” it may include the following:

• Medical information (such as medical record numbers, dates of service, types of lab tests, or procedure codes)
• Payment information (such as credit card information or bank account number)
• Insurance information (such as Medicaid/Medicare ID, policy numbers, or insurance claims)
• Government identification (such as Social Security numbers, tax identification numbers, driver’s license numbers, or passport numbers)
• Other personal information (such as dates of birth or addresses)

“Although patient data was involved, importantly, there remains no evidence that data was taken from our Electronic Health Records (EHR) and other clinical systems, where our full patient records are securely stored,” Ascension said in the new announcement.

The affected individuals should expect to receive the notice letters within the next 2-3 weeks. Ascension offers affected individuals 24 months of credit and CyberScan monitoring, a $1,000,000 insurance reimbursement policy, and fully managed ID theft recovery services.

Since the ransomware attack, Ascension has “successfully restored all systems, clinical functions, and Electronic Health Record (EHR) access that were impacted by the incident.”

Cybernew previously reported that this breach was caused by an employee accidentally downloading a malicious file. Ascension previously said the attackers accessed only seven of approximately 25,000 servers across the organization's networks.

The ransomware gang Black Basta is believed to have been responsible for the cyberattack.

Following the incident, the Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and other agencies released an advisory urging hospitals and all critical infrastructure organizations to apply the released recommendations.

Black Basta ransomware-as-a-service was first identified in April 2022, and since then, more than 500 organizations have fallen victim to it.