California hospital breach exposed patients’ Social Security numbers, medical info

A hospital in California’s Riverside County has reported a data breach to its patients including sensitive information like Social Security numbers and the details of medical care following an incident in the fall. 

According to the notice, beginning on October 29 an “unauthorized party” accessed the computer network of San Gorgonio Memorial Hospital, a 79-bed nonprofit facility in the small town of Banning. The hacker had access until November 10, when the breach was detected and “select” network systems isolated and shut off. The hospital hired an undisclosed third-party forensic firm.

“At this time, we have identified documents containing patient names, addresses, dates of birth, medical record numbers, visit ID numbers, and/or clinical information, such as dates of service, provider names, and/or department names,” the hospital wrote in a notice posted to its website. “In some instances, patients’ Social Security numbers, drivers’ license numbers, financial account information, and/or health insurance information may have also been reflected in the documents involved.”

The hospital did not disclose how many patients were potentially impacted in the breach, nor if the incident was a ransomware attack. The Record has contacted hospital administration for comment.  

The news outlet Patch reported in November that the hospital’s electronic records system was shut down for six days during the attack and staff reverted to taking handwritten notes.  

Ransomware attacks have been an ever-growing threat to the healthcare industry. A Sophos survey published in May found that two-thirds of healthcare organizations had been targeted by ransomware in the previous year, nearly double the amount in 2020. Last week, the U.S. Department of Health and Human Services warned of attacks on the healthcare industry from the Royal ransomware group.