A cyber criminal from the Ukraine admitted on twitter to stealing 105,000 documents from the Central Ohio Urology Group. The documents included patient names, diagnosis information, addresses, and dates of birth. The Urology group is meant to be the second biggest health system in the state with 24 locations.
A screenshot was posted on twitter by the alleged cyber criminal listing stolen information with claims that some 156GB of data had been uploaded to a Google Drive.
No comment has been made by the Central Ohio Urology Group, but one thing is for sure: this is a serious breach.
Data breaches involving health institutions are often the most serious, because the information leaked is often very personal, and highly confidential. We commonly represent victims for NHS data leaks here in the UK, including one of the most serious ones ever to have happened here in the UK involving the 56 Dean Street Clinic.
We know first hand how damaging health related leaks can be.
The potential problems for the patients whose information has been reportedly leaked could be huge.
Political motives
Lee Johnstone, founder of Cyber Wars News and security researcher, told ZDNet that the breach was caused by a document manager system dump. This involved over 54,500 PDF files; 46,000 Microsoft Word documents; and other data like system files like executable files and healthcare-related apps.
Many of the files that were stolen were internal documents from the health organisation, but some documents contained billing information, insurance-related files, and health reimbursement details.
Non-password protected Excel files with log files that included surgery details, doctors names and drug information were also contained in the breach.
The hack was supposedly carried out for political reasons with the hacker gaining access through SQL injection, which is an easy attack to perform on out-of-date systems, according to ZDNet.