3,700 plan members of Rise Wisconsin are being warned that some of their protected health information may have been obtained by unauthorized people during a recent ransomware attack.
It is estimated that the ransomware was placed on on its IT systems around April 8, 2018. The ransomware attack was identified swiftly, although not in time to avoid the encryption of data.
Rise Wisconsin (previously known as Community Partnerships Inc., and Center for Families) contracted third party computer forensics experts to help with the breach investigation and recovery process. While the review did not find any proof to suggest protected health information was accessed or taken in the hack, it was not possible to eliminate data access and data theft with a high degree of certainty.
The sort of data that possibly was accessed by the hackers includes names, addresses, dates of birth, Social Security numbers and, for certain patients, a limited amount of health data. No financial details were compromised.
Rise Wisconsin has not revealed how much the attackers sought in return for the security keys to unlock the encrypted data or whether that ransom demand was met.
Rise Wisconsin takes the security of health information very seriously and had put in place a range of security measures to prevent the unauthorized accessing of PHI. In this instance those controls proved insufficient; however, steps have now been taken to strengthen security and eliminate further incidents of this nature. Those measures include placing further restrictions on network access and increasing staff information security awareness education.
The incident has been made known to appropriate authorities and law enforcement is looking into the attack. The breach report filed to the Department of Health and Human Services’ Office for Civil Rights (OCR) states that 3,731 plan subscribers members have been affected by the cyber attack.