New York Blood Center Discloses Ransomware Attack Details
Published
- NYBC breach: The U.S. blood center announced details about the attack they first discovered on January 26.
- Ransomware attack: New York Blood Center revealed in regulatory filings that at least 10,500 people were impacted.
- What was stolen: Filings admit that some patient data and employee information were exposed to hackers.
One of the largest independent blood centers in the United States, the New York Blood Center (NYBC), has disclosed details of a ransomware attack that occurred in January. The incident resulted in a significant healthcare data breach, affecting thousands of patients and employees.
Attack Timeline and Data Compromise
The New York Blood Center ransomware attack affected at least 10,557 individuals from Texas, according to a regulatory filing. Yet, the total number of victims is not specified in either of the other filings.
The data breach was first detected on January 26. A subsequent investigation revealed that unauthorized actors had access to the center's network between January 20 and January 26. During this period, the attackers exfiltrated copies of certain files before deploying the ransomware.
The compromised information includes:
- sensitive patient data:
- names
- health information
- test results.
- current and former employees:
- Social Security numbers,
- driver's licenses,
- government ID cards,
- financial account information.
It is not yet known which threat actor group orchestrated the attack, and no claims have been made so far.
Response and Notification
Following the discovery of the ransomware attack on a blood center, NYBC initiated an investigation, which concluded on June 30. The process of identifying and compiling a final list of victims was completed by August 12.
NYBC announced on September 5 that the company is “unable to mail letters to individuals whose information may have been involved,” due to not collecting or storing patient contact information, but it established a dedicated call center to address questions from those potentially affected.
This incident highlights persistent issues related to cybersecurity in healthcare, as critical service providers remain high-value targets for cybercriminals. Recent incidents include the North Country HealthCare breach and the DaVita cyberattack.
Related
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular
Get expert insights on threats, breaches, scams, and security trends — delivered every Saturday.
Most Popular