MN: Associates in Psychiatry and Psychology disclose ransomware incident

Associates in Psychiatry and Psychology in Minnesota have notified 6,546 patients and HHS of a ransomware incident that occurred in March.

Some time overnight between March 30 and March 31st, the practice’s files were locked up with TripleM ransomware.  The ransomware not only locked up the data files, but according to their notification and FAQ on the incident, it disabled the system restore function on all affected computers and reformatted the network storage device where the practice had maintained its local backups.

The hackers, believed to be in Eastern Europe, also left a ransom note indicating the cost and payment method for restoring the systems.   In email to DataBreaches.net, Steve Patton, IT Director for the practice, stated that although the hackers initially demanded 4 BTC, the practice was able to negotiate it down to .5 BTC that they paid via BTC wallets.

Importantly, the practice found no evidence that any of the patient files had been accessed or exfiltrated.  The following are the practice’s notification and FAQ on the incident. My hat’s off to them (or would be, if I wore a hat) for the clarity of their writing and explanation of the incident. Well done, AAP!