Recently, Fitzgibbon Hospital appears to have been the victim of a ransomware attack that was carried out by a previously unknown group of cybercriminals who go by the name “DAIXIN Team.” Although Fitzgibbon Hospital has not yet confirmed the attack, DAIXIN Team took credit for the attack, sharing a link to a dark web website containing all the stolen data. Based on a preliminary review, it appears as though the compromised data includes patients’ names, dates of birth, medical record numbers, patient account numbers, Social Security numbers, and medical and treatment information.

If you received a data breach notification, it is essential you understand what is at risk and what you can do about it. To learn more about how to protect yourself from becoming a victim of fraud or identity theft and what your legal options are in the wake of the Fitzgibbon Hospital data breach, please see our recent piece on the topic here.

What We Know About the Fitzgibbon Hospital Data Breach

News of the Fitzgibbons Hospital breach is very recent, and the Hospital has not yet issued any public statements regarding the incident. That being the case, all information related to the breach comes from the attackers themselves, who reached out to HIPAA Journal to take credit for the attack. The hackers also provided a link to a dark web website where they published the stolen data.

Based on the available information, the stolen data includes database tables from the MEDITECH database as well as sensitive documents containing patient data stolen from internal servers. While the breached information varies depending on the individual, it may include patients’ names, dates of birth, medical record numbers, patient account numbers, Social Security numbers, and medical and treatment information.

There is also evidence that certain data related to Fitzgibbon Hospital employees was compromised, including their salary information. The breached data also included information about the Hospital’s data security system, including the results from previous internal audits the hospital conducted to identify vulnerabilities that needed to be addressed.

A representative from Fitzgibbon Hospital engaged with the hackers to discuss the payment of the demanded ransom. However, it does not appear as though a ransom was paid.

Fitzgibbon Hospital is a non-profit community hospital based in Marshall, Missouri. Fitzgibbon Hospital operates nine clinics in the area, including Marshall Family Practice, Mid-Missouri Family Health at Fitzgibbon, Marshall Orthopedic & Sports Medicine, Akeman-McBurney Medical Clinic, Slater, Fitzgibbon Family Health, Fayette, Grand River Medical Clinic, Brunswick, Fitzgibbon Chiropractic, Fitzgibbon Mental Health, Marshall Surgical Associates, Pilot Grove Medical Clinic at Fitzgibbon. Fitzgibbon Hospital employs more than 679 people and generates approximately $54 million in annual revenue.

What Are Ransomware Attacks?

While Fitzgibbons Hospital has not yet publicly disclosed that it was the victim of a ransomware attack, this information has been confirmed through the threat group that orchestrated the attack. So far in 2022, ransomware attacks have been the weapon of choice among many cybercriminals looking to extort companies for large sums of money. According to the Identity Theft Resource Center (“ITRC”), the number of ransomware attacks more than doubled between 2020 and 2021, going from 158 to 321. Each of these attacks, on average, affects thousands of individuals.

Given the frequency and risks of ransomware attacks, it is important for consumers to understand what they are, how they can be prevented, and what can be done in their aftermath to reduce the worst consequences, including identity theft and other frauds.

Ransomware attacks have been around for decades. However, the manner in which cybercriminals are carrying out these attacks changes over time. Historically, a traditional ransomware attack involved hackers installing malicious software on a victim’s device or computer network. This malicious software, or malware as it is often referred to, encrypts some or all of the data on the victim’s device or computer network and prevents the victim from accessing the network. When the victim tries to log in, they will see a message from the hackers demanding they pay a ransom if they want to regain access to their computer.

While any ransomware attack is a nuisance, the recent trend over the past few years is for hackers to threaten to publish the data they obtained from the victim, usually on the dark web, if the ransom is unpaid. This certainly adds to a company’s fear because once information is posted on the dark web, it is accessible to millions of people, most of which have less-than-honest intentions. Some hackers sell consumer data on the dark web, while others post it for free. In either case, a victim’s sensitive information is up for grabs.

It is imperative for those who were affected by the Fitzgibbons Hospital data breach to take the necessary steps to protect themselves. Data breach lawyers are currently investigating the Fitzgibbons breach and, depending on the outcome of this investigation, victims may be able to pursue a data breach class action lawsuit against the company. Those data breach victims who have questions about what to do after a ransomware attack or what their legal options are should reach out to a data breach lawyer for assistance.