- BayMark Health Services confirmed that it suffered a cyber attack in September 2024
- Crooks stole social security numbers, driver’s license numbers and more
- The company did not say how many people were affected
BayMark Health Services, a US healthcare provider that helps people treat and recover from substance abuse and mental health issues, has confirmed that it suffered a cyber attack and lost sensitive patient data.
In a filing with the California Attorney General, which includes a letter sent to affected individuals, BayMark said the attack happened in September 2024, but did not say how many people lost their data:
“On October 11, 2024, we learned of an incident that disrupted the operation of some of our IT systems. We took immediate steps to secure our systems, launched an investigation with the assistance of third-party forensic experts, and notified law enforcement,” it says there in the letter of breakup. “Our investigation determined that an unauthorized party accessed some of the files on BayMark’s systems between September 24, 2024 and October 14, 2024. We then began a review and analysis of those files.”
RansomHub
The subsequent investigation, which was completed in early November, determined that the threat actors took people’s social security numbers (SSN), driver’s license numbers, dates of birth, the types of services received, the date of service, insurance information, treating providers, and treatment/diagnosis data. More than enough for phishing, identity theft and other forms of cybercrime.
To mitigate the incident, BayMark is offering one year’s worth of Equifax identity monitoring services for free to affected patients.
Although the company did not discuss who the attackers were, Bleeping Computer revealed that the RansomHub ransomware gang claimed responsibility and added BayMark to its data leak site. There, the criminals said they stole 1.5 TB of sensitive data, which they also uploaded to the leak site. This would mean that BayMark most likely did not pay the ransom demand.
RansomHub is a relatively young ransomware operation that emerged after the infamous ALPHV group stole $22 million from ChangeHealthcare and disappeared.
Via Bleeping Computer
