Peoples Injury Network Northwest suffered from ransomware attack

Peoples Injury Network Northwest (also known as PINN) is physical rehabilitation company for the industrial rehabilitation patients. Kent, Washington-based PINN, with seven locations all over Washington, is providing a data security incident notice that may have affected anybody who was PINN's patient before Apr. 22, 2019.

On Aug. 8, 2019, PINN has discovered that some personal information as well as PHI (Protected Health Information) of patients along with former patients could possibly be at risk. The attack happened on Apr. 22, 2019, and resulted in three PINN servers getting infected with ransomware. This attack was discovered on the next day (i.e. on Apr. 23, 2019), and the infected servers were immediately taken offline by PINN. The decision to not pay ransom demand was taken, and the encrypted files have been restored from the backups. PINN reported that it was able to recover almost all data from the backups.

Moreover, to make sure that the systems of the company were secure as well as to determine whether any data has been compromised, a computer forensics company was retained by PINN for analyzing the servers. No evidence of data theft or unauthorized data access was discovered by the firm; however, it has not been possible to rule out possibility of the unauthorized data exfiltration or access.

Since the servers that were compromised contain personal information for the PINN patients till Apr. 22, 2019, so PINN as a precautionary measure was concluding that all information till that time might be at risk. The information possibly compromised contains both personal information as well as PHI, including name, date of birth, address, diagnosis information, and driver's license number.

The affected individuals were offered complimentary subscription to identity theft protection and credit monitoring services by ID Experts for one year. According to substitute breach notification letter of PINN, 12,502 residents of Washington were possibly affected by this attack. The notification letters have been sent on Sep. 12, 2019.

Peoples Injury Network Northwest said in their data security incident notice that "PINN values your trust and confidence in us, and we're committed to securing our information systems and your personal information and protected health information (PHI)".

» SPAMfighter News - 10/16/2019