Norton Healthcare, a major health system in Kentucky, reported a data breach following a ransomware attack on May 9, 2023. The incident exposed patient, employee, and dependent information, potentially including personal details, health records, and insurance information. The breach prompted Norton Healthcare to engage federal law enforcement, initiate an investigation, and offer two years of credit monitoring to affected individuals.
The healthcare provider, based in Louisville, Kentucky, operates over 40 clinics and hospitals in the region. Despite the breach, Norton Healthcare clarified that the intruders did not access the medical record system or Norton MyChart during the ransomware attack. However, unauthorized access to certain network storage devices occurred between May 7 and May 9, 2023.
The AlphV/BlackCat group claimed responsibility for the ransomware attack on Norton Healthcare, asserting the exfiltration of 4.7 TB of data. In response, the group leaked proof of the hack by exposing numerous files. The incident underscores the persistent threat of cyberattacks on healthcare systems, with the attackers specifically targeting and compromising sensitive medical and personal information.
As Norton Healthcare grapples with the aftermath of the breach, the disclosure highlights the evolving challenges faced by healthcare organizations in safeguarding patient data. The two-year credit monitoring assistance aims to mitigate potential repercussions for individuals affected by the compromise of their personal and health-related details. The incident sheds light on the importance of robust cybersecurity measures within the healthcare sector to protect sensitive information from unauthorized access and ransomware threats.
