River Region Cardiology, based in Montgomery, Alabama, recently disclosed a data breach involving sensitive personal identifiable information (PII) and protected health information (PHI). On September 16, 2024, the healthcare provider detected unauthorized access to its systems and launched an investigation to assess the extent of the incident. The breach appears to have been caused by a cyber-attack targeting a remote connection used by one of its vendors, potentially exposing sensitive data.
The affected information includes names, social security numbers, dates of birth, weight, height, and sex. While the specifics vary for each individual, the breach highlights the risks posed by third-party vendors with remote access to systems containing critical personal and health data. River Region Cardiology is actively working to understand the full scope of the exposure and the specific individuals impacted.
In response to the breach, River Region Cardiology has posted a notice on its website and plans to notify affected individuals once its investigation is complete. The healthcare provider has not yet provided specific details on how many individuals are affected, but it emphasizes that the investigation is ongoing.
The breach also underscores the vulnerability of health organizations to cyber-attacks, particularly through third-party connections.
River Region Cardiology provides a range of cardiovascular services, including non-invasive, invasive, and interventional procedures such as stress tests, electrocardiograms, and coronary angiography. The breach, which resulted in potential exposure of personal and medical information, has prompted the healthcare provider to enhance its cybersecurity measures and ensure that its systems and vendor connections are secure to prevent future incidents.
Reference:
