The Largest Healthcare Breach on Record
A cyberattack on a major US healthcare data clearinghouse exposed the personal and medical records of an estimated 400 million patients, according to the Department of Health and Human Services. The attack, which used ransomware, disrupted claims processing for thousands of hospitals and pharmacies for two weeks.
What Was Exposed
- Full names, Social Security numbers, and dates of birth
- Insurance claim data including diagnoses and prescription histories
- Banking and payment information for some patients
Response and Fallout
The company paid a ransom of $22 million in cryptocurrency before discovering the attackers had retained a copy of the data regardless. Congressional hearings have been called, and the FBI is investigating with assistance from international cybercrime units.
"This is a catastrophic failure of both technical controls and corporate governance. Hundreds of millions of people did not consent to having their most sensitive data held by a single, under-protected intermediary," said a cybersecurity policy expert.
