Another Medical Information Breach Out of Chicago, Notifications Begin
- By Steven
- Published: Oct 19, 2023
- Last Updated: Nov 23, 2023
Chicago’s health providers are prime targets for opportunistic hackers; Cook County Health is the most recently discovered victim of a cyber assault. Assailants took advantage of a third-party medical transcription service Perry Johnson & Associates, Inc. (PJ&A) provided. The attack targeted PJ&A’s systems, resulting in the exposure of numerous patient records. If hackers accessed your information during the breach, there’s still time to protect yourself.
How Did the Attack Occur?
An unauthorized individual accessed PJ&A’s systems in a reported “data security incident”. The accessed systems were where PJ&A stored some patient information. Nothing else is public knowledge about the attack or how it happened; however, we might speculate that it occurred following a hacking event, absolving employees of negligence and rejecting system vulnerabilities. The attackers accessed personal and medical information from PJ&A’s system.
What Information was Viewed or Stolen?
The Cook County Health Notice of Incident lists personal and medical information as possibly exposed. They emphasize the information may have included the patient’s name and some permutation of the following details: addresses, dates of birth, medical record numbers, medical histories, dates of service, and Social Security Numbers. More than 500 patients have had their details stolen due to this breach; they may be at risk of identity or medical fraud.
How Did Cook County Health Admit to the Breach?
Beginning in April 2023, the assailants broke into PJ&A’s system. About two months later, on or around July 21st, PJ&A informs Cook County Health of the breach while continuing their internal investigation. A few days later, PJ&A confirmed that the breach may impact some patient data; Cook County Health terminated their relationship with PJ&A in response. On October 9th, PJ&A provided an impact patient list to Cook County Health and began sending breach notifications.
What Will Become of the Stolen Information?
Nothing is public about the attackers or their motivations; it’s challenging to say how they may use the information. As mentioned above, the exposed information puts patients at risk for various fraud schemes. They are at risk from more than fraud.
The hackers could sell the data to others on the dark web or to the highest bidder; the thieves could hide it for leverage until later. That’s what happened to global sporting goods store Decathlon. Their breach happened in 2021—it returned with potentially 8,000+ exposures earlier this week.
What Should Affected Parties Do in the Aftermath of the Breach?
Cook County Health’s notice states they will offer impacted parties credit and identity monitoring. Although, the department does not have evidence of the misuse of personal information. Request an Explanation of Benefits every six months and ensure the listed services align with your experiences. If they don’t match up, you might be a victim of medical fraud.
If you suspect thieves stole your information in this breach, take proactive steps to guard yourself. Don’t wait for the breach notice to look into credit or identity monitoring—sign up immediately to help mitigate threats.
