Dive Brief:
Data from nearly 5.6 million people was exposed due to a ransomware attack on nonprofit health system Ascension this spring, according to a report to federal regulators.
The attack compromised personal information from some current and former Ascension patients, senior living residents and employees, the system said on Thursday. Personal details, medical information, payment information, insurance details and government ID numbers, including Social Security numbers, could have been exposed.
The breach is the third largest reported to the HHS’ Office for Civil Rights’ healthcare data breach portal this year, trailing only incidents at Change Healthcare and Kaiser Foundation Health Plan.
Dive Insight:
Ascension, one of the nation’s largest nonprofit health systems, was hit by a ransomware attack in May.
The attack took some critical technology systems offline, including Ascension’s electronic health record system and patient portal. Some facilities were forced to divert ambulances, and the health system paused some elective care in the wake of the incident.
The attack also slammed Ascension’s bottom line. The provider posted a $1.1 billion net loss in its 2024 fiscal year, noting its financial improvement from the previous year was significantly hamstrung by the cyberattack.
In June, Ascension reported that cybercriminals gained access to its systems after a worker accidentally downloaded a malicious file, and that personally identifiable and protected health information may have been exposed.
Now, the health system has completed its review of what data may have been compromised. Ascension is mailing letters to affected people, which should be delivered over the next two to three weeks, the health system said in an update Thursday.
Though patient data was involved, Ascension said it found no evidence that data was stolen from EHR and other clinical systems, where full patient records are stored.
The Ascension breach comes at the tail end of a challenging year for healthcare cybersecurity. The attack on UnitedHealth-owned technology firm and claims processor Change disrupted the industry for weeks early this year, and it exposed data from 100 million people — the largest healthcare breach ever reported to federal regulators.
Other large breaches in 2024 include Kaiser Foundation Health Plan, which exposed data from 13.4 million current and former plan members, and health benefits administrator HealthEquity, which impacted 4.3 million people.
