Another massive data breach announcement has made headline, this time for healthcare and wellness program provider Atrium Health, formerly known as Carolinas HealthCare Systems, according to a joint announcement from Atrium Health and AccuDoc.
After one of its third-party vendors, AccuDoc Solutions, was hacked, Atrium Health announced that approximately 2.65 million patient records were potentially compromised. The data possibly compromised includes patient insurance policy information, medical record numbers, invoice numbers, addresses, dates of birth and social security numbers.
“Third-party risk management isn't just a security problem anymore. These issues are making their way up to the board because higher levels of risk deter business success and growth,” said George Wrenn, CEO and founder, CyberSaint Security.
“Every stakeholder should have easily accessible visibility into where risks lie within any given vendor list and should be able to have the insights from that information to take meaningful action. There needs to be a better way to manage the growing risk that comes with expanding businesses."
According to the news release, though, AccuDoc and Atrium Health did take meaningful action. Once AccuDoc discovered that a malicious actor had gained unauthorized access, it launched a forensic investigation and “took steps to secure its affected databases and enhance its security control...and informed Atrium Health of the incident on October 1, 2018."
The company continues to monitor its systems for any anomalous activity. AccuDoc also noted that it currently does not have any evidence that any personal information was taken from its systems.
Atrium Health has its own forensic investigator conducting an independent review of the incident. Both companies have been in contact with the FBI.
“Just when we thought things might be improving in healthcare data security, the Atrium Health Breach repositions 2018 as a record year for healthcare cyber attackers. Healthcare security, both on-premise and in the cloud, has not caught up with best practices and likely won’t do so anytime soon,” said Pravin Kothari, CEO of CipherCloud.