Hospital Español Auxilio Mutuo de Puerto Rico didn’t discover on their own that their systems had been compromised, and then, despite outside expert help, they were unable to determine with precise confidence whose data was exfiltrated or whether it has been misused, but the hospital has now started notifying patients potentially affected by a breach…
Author: Dissent
Chinese Ghost Hackers Hit Hospitals And Factories In America And U.K.
Davey Winder reports: There are two types of scumbag in the cybercrime world: those who pick on vulnerable individuals to perpetrate their fraud, and those who target healthcare in search of illicit financial gains. The latter are, thankfully, much rarer than the former. However, hospitals have been on the ransomware and hacking radar before now,…
Behavioral Health Resources of Washington state updates its data breach disclosure
On January 17, Behavioral Health Resources (“BHR”) notified the U.S. Department of Health and Human Services (HHS) of a reportable breach, but not yet having determined the number affected, they used “501” as a placeholder. They also published a preliminary notice on their website. That notice indicated that on or about November 20, 2024, they…
Breaches Within Breaches: Contractual Obligations After a Security Incident
Roma Patel writes: We often cover consumer class action complaints against companies regarding the privacy and security of personal information. However, litigation can also arise from alleged breach of contract between two companies. This week, we will analyze a medical diagnostic testing laboratory’s April 2025 complaint against its managed services provider for its alleged failure…
Baltimore City State’s Attorney’s Office hacked; Data leaked
One of the many cyberattacks that has escaped recent media attention is an incident involving the Baltimore City State’s Attorney’s Office in Maryland. Yesterday, data from the incident was leaked. The group known as Kairos added stattorney[.]org to its leak site on March 31, 2025. At that time, Kairos claimed that they had acquired 325 GB…
Don’t be so quick to claim there’s no reason to believe there’s compromise of patient info: Saturday edition
Here’s today’s example of how an entity may claim that they had no reason to believe patient data had been compromised, only to find that it had been. In February, Whitman Hospital & Medical Clinics (“WHMC”) in California discovered they had been the victim of a cyberattack that occurred between December 26 and February 28….