6,092 Patients were notified by FABEN Obstetrics and Gynecology about Ransomware-Related Data Loss

FABEN Obstetrics and Gynecology based in Florida fall prey to a ransomware attack that encrypted the server files and resulted in permanent loss of some data.

On November 21, 2018, officials discovered that a server containing the patient files between January 2007 and April 2017 was infected by a GandCrab ransomware. The variant got spread by malvertising campaigns which direct the users to a website that is infected with exploit kit, and then targets Windows VBScript engine or Adobe Flash
vulnerabilities in order to install that malware.

In the first 3weeks of Quarter 1 2018, 50,000 systems were infected by GandCrab. Upon discovery, the officials said that they have deleted infected files in order to mitigate effects of that attack. FABEN, the Florida-based specialist, stressed that the data was not accessed, exfiltrated, nor sent from infected server. Also, only data between January 2007 and April 2017 got impacted.

The officials were successful in restoring the diagnoses as well as treatment information, like patient visits. However, the problem is while most of the patient records have back-ups and thus restored, "certain records are not recoverable". Those files includes the items that are manually scanned into system by the FABEN and certain information from the medical charts that was created between September 11, 2014, to April 10, 2017, like patient visits, as well as labor and delivery.

Thus, FABEN lost files permanently including blood pressure logs, blood sugar logs, Family and Medical Leave Act documentation, as well as medical records that was provided to OB-GYN in the paper form from Sep. 2014 and Apr. 2017. All 6,092 patients visiting FABEN during that same time period are being notified.

The officials said in a statement that "receipt of this notification doesn't necessarily mean that any of your records are compromised. However, there is a possibility that certain files concerning your care and information, as described above, were deleted and or compromised as a result of the ransomware".

As many permanently lost files actually were brought by the patient itself, so the officials said to those patients that they should consult FABEN to determine which files were missing and could be replaced.

» SPAMfighter News - 2/15/2019