128,000 patients at the Arkansas Oral Facial Surgery Center in Fayetteville have had their private information potentially impacted following a a ransomware.
Ransomware was believed to have been placed on its network between July 25 and 26, 2017. The attack was identified quickly, although not before files, x-ray images, and documents had been encrypted. The incident did not break through the encryption of its patient database, except for a ‘relatively limited’ set of patients who data related to their recent visits encrypted. Those patients had visited the center for medical services in the three weeks before to the ransomware attack.
The ransomware attack is still under review, although to date, no proof of data theft has been located. Arkansas Oral Facial Surgery Center believes the sole aim of the attack was to extort money, and not to steal data; however, it has not been possible to eliminate data access or data theft with a high degree of certainty.
The files and images that were possibly accessed included data such as names, addresses, dates of birth, Social Security numbers, health insurance details, medical diagnoses, health conditions, treatment information and other clinical information. The ransomware attack has also rendered files, medical images and specific details of visits unavailable.
As sensitive protected health information has possibly been accessed, patients are now being notified of the breach by mail. All impacted people have been offered identity repair and credit monitoring services through AllClear ID for 12 months for free.
Arkansas Oral Facial Surgery Center has advised patients to be alert for phishing attacks following the breach and has confirmed it would not request any personal data via the telephone or email in relation to the breach. If any calls or emails are received, patients should be very cautious and treat them as potential phishing attacks
