Broward Health suffered a data breach that impacted +1.3 million people

The Broward Health public health system disclosed a massive data breach that has impacted more than 1.3 million individuals.

The Broward Health public health system has suffered a data breach that impacted 1,357,879 individuals.

Broward Health, formally the North Broward Hospital District, is one of the 10 largest public health systems in the U.S. Located in Broward County, Florida, Broward Health currently operates more than 30 healthcare facilities.

The attack took place on October 15, 2021, when threat actors breached the hospital’s network and accessed patient data. The healthcare system discovered the security breach on October 19, and reported the incident to local authorities, it also hired a third-party cybersecurity expert to help with the investigations.

According to the investigation, the attackers compromised a third-party medical provider who was permitted access to the system to provide their services.

“On October 15, 2021, an intruder who gained unauthorized access to the Broward Health network may have accessed some of your personal information. Broward Health discovered the intrusion on October 19, 2021.” reads the data breach notification letter sent to the impacted individuals. “The investigation determined the intrusion occurred through the office of a third-party medical provider who is permitted access to the system to provide healthcare services. Broward Health also engaged an experienced data review specialist to conduct an extensive review of the data, which determined that your personal medical information was included in data accessed by the intruder. We are alerting you to this situation now that the involvement of your personal medical information has been confirmed.”

The company notified urged employees to change their user passwords.

Threat actors gained access to patients’ information that may have included name, date of birth, address, phone number, financial or bank account information, Social Security number, insurance information and account number, medical information including history, condition, treatment and diagnosis, medical record number, driver’s license number and email address.

Broward Health has no evidence that the attackers misused the information.

In response to this incident, Broward Health is taking steps to prevent similar security breaches in the future. The company forced a password reset and is implementing multifactor authentication for all users of its systems.

“We have also begun implementation of additional minimum-security requirements for devices that are not managed by Broward Health Information Technology that access our network, which will become effective in January 2022.” continues the letter.

The company is offering a two-year membership of identity theft detection and protection services through Experian.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Broward Health)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.