Reference no: EM133108962

Help Summarize this article

Around 4 a.m. on Thursday June 17, 2021, St. Joseph's/Candler (SJ/C) hospital system in Savannah, GA suffered a ransomware attack. Upon detection of suspicious network activity, SJ/C immediately took steps to isolate and secure its systems. The attack prevented access to computer systems and emergency protocols were implemented, with staff reverting to pen and paper to record patient data.

SJ/C notified law enforcement about the security breach and launched an investigation. Assisted by third party cybersecurity firms, SJ/C determined the hackers first gained access to its systems on December 18, 2020 and continued to have access to those systems until June 17, 2021, when the ransomware was deployed.

"Patient care operations continue at our facilities using established back-up processes and other downtime procedures," explained SJ/C in a statement shortly after the attack was detected. "Our physicians, nurses and staff are trained to provide care in these types of situations and are committed to doing everything they can to mitigate disruption and provide uninterrupted care to our patients."

As the investigation into the breach continued it became clear that the parts of the network accessible to the hackers contained files that included patients' protected health information. A comprehensive review of those files was conducted and determined the files contained patient information such as names, addresses, dates of birth, Social Security numbers, driver's license numbers, patient account numbers, billing account numbers, financial information, health insurance plan member IDs, medical record numbers, dates of service, provider names, and medical and clinical treatment information regarding care received from SJ/C.

SJ/C has now confirmed the protected heath information of 1,400,000 patients was potentially compromised in the ransomware attack. Notification letters started to be sent to affected individuals on August 10, 2021 and complimentary credit monitoring and identity theft protection services are being offered. SJ.C said additional safeguards and technical security measures are being implemented to further protect and monitor its systems.