Cyberattacks May Have Compromised Health Care Data of More Than 21,000 People

A computer keyboard lit by a displayed cyber code on March 1, 2017. Kacper Pempel/Reuters

Multiple U.S. health care entities report being victimized in recent cyberattacks that may have compromised thousands of customers’ data.

Georgia-based Artivion and Ciox Health and Maryland-based Amergis have reported data breaches since last month. The intrusions involving Ciox and Amergis affected more than 21,000 people. The most recent attack targeted Artivion, a manufacturer and distributor of medical devices.

The cybersecurity incident at Artivion was identified on Nov. 21, the company reported in a Dec. 9 filing with the U.S. Securities and Exchange Commission. According to the company, the attack involved hackers acquiring and encrypting its files. Artivion said it has taken measures to deal with the situation.

Although the company continues to provide services to customers, the data breach “has caused disruptions to some order and shipping processes, as well as to certain corporate operations, which have largely been mitigated,” the company stated.

Artivion said it expects to incur certain costs related to the incident that won’t be covered by insurance.

The data breach poses various risks, such as delays in restoring full operations, that could have a “material impact” on the company in the future, Artivion said, without providing further details.

On Dec. 6, health care data tech company Ciox Health started sending notices to customers affected by a data breach in May. The company’s email users were subjected to a phishing attack, which it said was resolved on the same day.

In a filing with the Maine attorney general, Ciox revealed that 10,639 customers were affected, with names and other personal identifiers potentially stolen. The company is providing 24 months of credit monitoring and identity theft protection services to individuals affected by the breach.

Customers of Amergis were affected by a data breach that took place in February. The health care staffing company notified its users of the incident on Nov. 29. Amergis estimates that 11,329 individuals were affected, with their names and other personal details potentially compromised.

The hackers reportedly compromised the company’s email system, gaining access to customer data. Amergis said it currently has no evidence that the stolen information has been misused.

Targeting Health Care Sector

Attacks involving ransomware against health care organizations continue to rise globally, according to an annual review from IT services company Barracuda.

Ransomware is a type of malware that hackers use to encrypt files on a device or network. As a result, the data owner is unable to use these files and is forced to pay the hackers to decrypt them.

The firm’s researchers investigated 200 breach incidents reported between August 2023 and July 2024, finding that “over one in five attacks (21 percent) hit healthcare in 2023/24, up from 18 percent a year ago.”

“Some of these made global headlines, with operations postponed and long-term treatment plans disrupted,” the review stated.

A September report from Check Point Research identified health care as the third most commonly targeted industry in terms of cyberattacks.

The average number of weekly attacks per entity in the sector was 2,018 between January and September, up by almost one-third from last year.

In February, a data breach at UnitedHealthcare’s Change Healthcare unit resulted in the data of roughly 100 million Americans being compromised. This was the biggest health care data breach incident ever reported in the United States.

Compromised information was estimated to include names, phone numbers, medical record numbers, health insurance details, diagnoses, financial and banking information, and a host of other crucial data.

Lawmakers are taking action to tackle the security crisis. In November, a group of bipartisan senators introduced the Health Care Cybersecurity and Resiliency Act of 2024.

The bill would require the Department of Health and Human Services to develop a cybersecurity incident response plan. It seeks to offer grants to health care organizations to boost their response to cyber intrusions. The entities would be provided with training related to cybersecurity best practices.

Sen. Bill Cassidy (R-La.), a bill co-sponsor, said it would safeguard the health data of American citizens against cyberattacks. Such incidents not only compromise data “but can delay life-saving care,” he said.

Sen. Maggie Hassan (D-N.H.), another co-sponsor, said, “Cyberattacks in the health care sector can have a wide range of devastating consequences, from exposing private medical information to disrupting care in ERs—and it can be particularly difficult for medical providers in rural communities with fewer resources to prevent and respond to these attacks.”