Connecticut’s largest healthcare provider, Yale New Haven Health, has reported a significant data breach impacting more than 5.5 million people, according to a notification filed with the U.S. Department of Health and Human Services.
The breach, which took place in March, allowed cybercriminals to gain access to a wide range of sensitive patient information. According to a statement posted on Yale New Haven Health’s website, the compromised data varies depending on the individual but may include names, birth dates, mailing and email addresses, phone numbers, and information regarding race and ethnicity. In some cases, Social Security numbers, medical record numbers, and details about the type of patient services received were also exposed.
Local reports cited a spokesperson from the healthcare system, who noted that the final number of affected individuals could still change as the investigation progresses.
When asked about the nature of the incident, Yale New Haven’s spokesperson Dana Marnane did not deny the possibility that ransomware was involved. “The sophistication of the attack suggests it was carried out by a party experienced in similar breaches,” Marnane stated, adding that further details could not be shared due to an active investigation by law enforcement authorities.
The healthcare system has not disclosed whether any communication took place with the attackers or if any ransom demands were made. So far, no known ransomware group has come forward to claim responsibility for the breach. It is worth noting that it is common practice among ransomware and extortion groups to release stolen information publicly if a ransom is not paid.
This breach marks the second major healthcare-related data incident disclosed this week. Earlier, Blue Shield of California admitted to inadvertently sharing the health data of approximately 4.7 million patients with Google over several years.
As cyberattacks against healthcare organizations continue to rise, experts stress the importance of robust cybersecurity defenses. Healthcare data is particularly valuable to hackers due to the wealth of personal and medical information it contains, often making the industry a prime target.
Yale New Haven Health has assured affected individuals that it is working with cybersecurity experts and law enforcement to fully assess the breach and take the necessary steps to protect patient information moving forward.
