Cyberattacks on Healthcare Providers Including Varian Medical Systems and Bi-Bett Corporation

LockBit Ransomware Group Threatens to Expose Stolen Cancer Patient Information

The LockBit ransomware group included Varian Medical Systems to its data leak website and made threats to post the information of cancer patients when there is no ransom payment received. Varian Medical Systems is a provider based in Palo Alto, CA offering radiation oncology treatments and software for oncology sections, and is a Siemens Healthineers subsidiary. Varian Medical Systems hasn’t confirmed the data breach. The LockBit group has no mention yet regarding the amount of information stolen during the attack nevertheless stated Varian has until August 17, 2023, to negotiate otherwise it will publish all stolen databases and patient information on its dark web data leak website.

Karakurt Threat Group Stole Data from McAlester Regional Health Center

The KaraKurt ransomware group has just included McAlester Regional Health Center to its data leak website and states it has stolen over 1,175 GB of information from the Oklahoma hospital, which includes 5 GB of SQL data on health employees and medical reports that contain sensitive patient data, including DNA information. Based on the listing, the stolen worker information consists of bank account details and Social Security numbers. The ransomware group has threatened to peddle the information if there’s no ransom payment. McAlester Regional Health Center hasn’t confirmed the claim nor the data breach on its site or reported the attack to the HHS’ Office for Civil Rights.

Precision Anesthesia Billing LLC Announces PHI Breach Affecting 209,200 Individuals

The HIPAA business associate, Precision Anesthesia Billing LLC (PAB) based in Tampa, FL, submitted the report of a breach that affected the PHI of 209,200 persons to the HHS’ Office for Civil Rights on July 7, 2023. Although there is no public notice regarding the data breach, the Athens Anesthesia Associates (AAA) medical group has affirmed that it was impacted by the breach.

AAA stated that PAB notified on May 11, 2023 that the information of a few of its patients were potentially exposed. PAB mentioned a popular cyber threat actor was responsible for the cyberattack but didn’t say the group’s name. PAB succeeded in stopping the attack and protected its systems nevertheless it was probable that files with patient information were viewed and extracted files from its systems on May 4 to May 7, 2023. The data breached in the incident contained names, addresses, telephone numbers, email addresses, birth dates, ages , bank account numbers, Social Security numbers, diagnoses, treatment details and dates, ultrasound photos, medical record numbers, and hospital account numbers. AAA stated it has provided impacted individuals with 24 months of free credit monitoring services.

19,107 Individuals Affected by Life Management Center of Northwest Florida Cyberattack

On March 31, 2023, Life Management Center of Northwest Florida, a behavioral health, mental health, and family counseling services provider, uncovered a security breach. It took action promptly to protect its system and engaged third-party forensics specialists to look into the incident. The investigation revealed that an unauthorized individual viewed files that included patient information. A thorough analysis of the impacted files ended on May 26, 2023 and confirmed the compromise of the protected health information (PHI) of 19,107 persons, which include names, driver’s license numbers, Social Security numbers, medical insurance data, medical treatment and/or diagnosis data. Impacted persons were advised on July 25, 2023 and were offered free credit monitoring services.

Discovery at Home Suffers Phishing Attack

Discovery at Home, a home healthcare services provider to seniors located in Texas and Florida, encountered a phishing attack on or about June 1, 2023, that allowed an unauthorized person to access an employee’s email account. Discovery at Home stated the attack led to the inadvertent sending of personal health data through unencrypted e-mail to a suspicious third-party sender.

The breached data contained names, addresses, birth dates, dates of service, treatment-associated data, and medical insurance data, such as policy number, insurance beneficiary number, and claim number. During the time of sending breach notification letters, Discovery at Home did not know of any compromised data misuse. Discovery at Home mentioned the email account was promptly kept secure when the breach was discovered, steps were undertaken to strengthen email security, and the staff involved has gotten additional data security training. Impacted persons were informed via mail on July 31, 2023.

The incident is not yet published on the HHS’ Office for Civil Rights breach website, the number of affected individuals is currently unclear.

Email Account Breach at Bi-Bett Corporation

Bi-Bett Corporation, a substance use disorder treatment services provider in California, has just informed 4,722 patients about an unauthorized third party that accessed some of their PHI kept in an email account. The provider identified suspicious activity in the email account on February 17, 2023, and quickly secured the email account. A third-party cybersecurity agency investigated the incident and confirmed on April 14, 2023 that patient data could have been viewed or obtained.

An email account audit was conducted to determine the impacted persons and the data that had been breached. That process concluded on May 22, 2023 and revealed the compromise of the following information: first and last names, addresses, driver’s license numbers, Social Security Numbers, medical reference numbers and/or Medicaid numbers. Bi-Bett stated that together with third-party security specialists, it is further strengthening its security posture. Impacted persons were provided with free credit monitoring and identity theft protection services.

About the Author

Elizabeth Hernandez
Elizabeth Hernandez is the editor of HIPAA News. Elizabeth is an experienced journalist who has worked in the healthcare sector for several years. Her expertise is not limited to general healthcare reporting but extends to specialized areas of healthcare compliance and HIPAA compliance. Elizabeth's knowledge in these areas has made her a reliable source for information on the complexities of healthcare regulations. Elizabeth's contribution to the field extends to helping readers understand the importance of patient privacy and secure handling of health information. Elizabeth holds a postgraduate degree in journalism. You can follow Elizabeth on twitter at