Pierluigi Paganini January 04, 2022

The Broward Health public health system disclosed a massive data breach that has impacted more than 1.3 million individuals.

The Broward Health public health system has suffered a data breach that impacted 1,357,879 individuals.

Broward Health, formally the North Broward Hospital District, is one of the 10 largest public health systems in the U.S. Located in Broward County, Florida, Broward Health currently operates more than 30 healthcare facilities.

The attack took place on October 15, 2021, when threat actors breached the hospital’s network and accessed patient data. The healthcare system discovered the security breach on October 19, and reported the incident to local authorities, it also hired a third-party cybersecurity expert to help with the investigations.

According to the investigation, the attackers compromised a third-party medical provider who was permitted access to the system to provide their services.

“On October 15, 2021, an intruder who gained unauthorized access to the Broward Health network may have accessed some of your personal information. Broward Health discovered the intrusion on October 19, 2021.” reads the data breach notification letter sent to the impacted individuals. “The investigation determined the intrusion occurred through the office of a third-party medical provider who is permitted access to the system to provide healthcare services. Broward Health also engaged an experienced data review specialist to conduct an extensive review of the data, which determined that your personal medical information was included in data accessed by the intruder. We are alerting you to this situation now that the involvement of your personal medical information has been confirmed.”

The company notified urged employees to change their user passwords.

Threat actors gained access to patients’ information that may have included name, date of birth, address, phone number, financial or bank account information, Social Security number, insurance information and account number, medical information including history, condition, treatment and diagnosis, medical record number, driver’s license number and email address.

Broward Health has no evidence that the attackers misused the information.

In response to this incident, Broward Health is taking steps to prevent similar security breaches in the future. The company forced a password reset and is implementing multifactor authentication for all users of its systems.

“We have also begun implementation of additional minimum-security requirements for devices that are not managed by Broward Health Information Technology that access our network, which will become effective in January 2022.” continues the letter.

The company is offering a two-year membership of identity theft detection and protection services through Experian.

Follow me on Twitter: @securityaffairs and Facebook

Pierluigi Paganini

(SecurityAffairs – hacking, Broward Health)

[adrotate banner=”5″]

[adrotate banner=”13″]