DEAR PATIENT: WE GOT HACKED Health care giant Ascension says 5.6 million patients affected in cyberattack Intrusion caused medical errors and diversion of emergency services. Dan Goodin Dec 23, 2024 12:21 pm | 33 Credit: iStock / Getty Images Plus Credit: iStock / Getty Images Plus Story textSizeSmallStandardLargeWidth *StandardWideLinksStandardOrange* Subscribers only Learn moreHealth care company Ascension lost sensitive data for nearly 5.6 million individuals in a cyberattack that was attributed to a notorious ransomware gang, according to documents filed with the attorney general of Maine.Ascension owns 140 hospitals and scores of assisted living facilities. In May, the organization was hit with an attack that caused mass disruptions as staff was forced to move to manual processes that caused errors, delayed or lost lab results, and diversions of ambulances to other hospitals. Ascension managed to restore most services by mid-June. At the time, the company said the attackers had stolen protected health information and personally identifiable information for an undisclosed number of people.Investigation concludedA filing Ascension made earlier in December revealed that nearly 5.6 million people were affected by the breach. Data stolen depended on the particular person but included individuals' names and medical information (e.g., medical record numbers, dates of service, types of lab tests, or procedure codes), payment information (e.g., credit card information or bank account numbers), insurance information (e.g., Medicaid/Medicare ID, policy number, or insurance claim), governmentidentification (e.g., Social Security numbers, tax identification numbers, drivers license numbers, or passport numbers), and other personal information (such as date of birth or address).Ascension is now in the process of notifying affected individuals. The organization is also offering two years of credit and fraud monitoring, a $1 million insurance reimbursement policy, and managed ID theft recovery services. The services became effective last Thursday.According to CNN, the attack on Ascension was the work of Black Basta. The ransomware group never took credit for the breach, and neither did any other group, an indication Ascension may have paid a ransom in exchange for the attackers not releasing stolen data publicly. The US Department of Health and Human Services has ranked the breach as the third-largest health care-related breach of this year."Since the May ransomware attack, we have been working with third-party experts to investigate what individuals data may have been involved in this incident," Ascension said in a post on its website. "That review of the data is now complete, and starting today Ascension will begin the process of notifying individuals whose personal information was involved in this incident and providing them with complimentary credit monitoring and identity protection services."Dan GoodinSenior Security EditorDan GoodinSenior Security Editor Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Dan is based in San Francisco. Follow him at here on Mastodon and here on Bluesky. Contact him on Signal at DanArs.82. 33 Comments