Boston Children’s Health Physicians (BCHP), a multi-specialty healthcare group providing pediatric care across Connecticut and New York, recently notified patients and staff of a significant data breach following a cyberattack. The BCHP cyberattack, which stemmed from an IT vendor’s systems, compromised sensitive information belonging to current and former employees, patients, and guarantors.
The healthcare organization, which employs over 300 clinicians, emphasized that it quickly responded to the incident, implementing its incident response protocols as soon as the breach was discovered.
Timeline of the BCHP Cyberattack
The cyberattack on BCHP occurred on September 6, 2024, when BCHP’s IT vendor identified unusual activity on its systems. Four days later, on September 10, BCHP discovered that an unauthorized third party had gained access to parts of its network. This unauthorized party managed to exfiltrate certain files from the organization’s network, triggering a swift response. BCHP immediately shut down its systems as a precautionary measure and launched an investigation with the help of a third-party forensic firm.
The healthcare provider has since taken steps to enhance the security of its systems and prevent further incidents of this nature. However, the damage had already been done, with files containing sensitive information being compromised during the breach.
Data Exposed in the BCHP Data Breach
The compromised files contained a wide range of sensitive data, including names, Social Security numbers, billing details, addresses, driver’s license numbers, medical record numbers, and health insurance information. The BCHP data breach affected not only patients but also current and former employees, as well as guarantors linked to the organization.
While BCHP confirmed that its electronic health records (EHR) were on a separate network and remained unaffected by the cyberattack, the breadth of the exposed data is significant. The organization has since begun notifying affected individuals and has offered complimentary credit monitoring and protection services to those whose Social Security or driver’s license numbers were involved in the breach.
BianLian Group Claims Responsibility
The BianLian cyberthreat group, a well-known ransomware gang, has claimed responsibility for the BCHP cyberattack. This group has been linked to several high-profile cyberattacks targeting critical infrastructure. In May 2023, the FBI and the Cybersecurity and Infrastructure Security Agency (CISA) issued a joint alert warning entities about BianLian’s methods and the potential consequences of falling victim to their ransomware campaigns.
BianLian has been particularly active in 2024, with data from cybersecurity research firm Comparitech indicating the group has claimed responsibility for 60 confirmed ransomware attacks this year alone. In BCHP’s case, the group allegedly exfiltrated the stolen files and may have demanded a ransom to prevent the further dissemination of the compromised data. However, BCHP has not publicly commented on any ransom demands or whether it engaged with the cybercriminals.
BCHP’s Response and Next Steps
In a public statement posted on its website, BCHP acknowledged the breach and detailed the steps it is taking to mitigate its impact. According to the statement, the organization began notifying affected individuals via mail starting on October 4, 2024. BCHP has also set up a dedicated toll-free hotline to address concerns and answer questions from those potentially affected.
BCHP encouraged individuals whose information was compromised to monitor their healthcare billing statements and report any unauthorized charges to their insurers immediately. For those affected, particularly those whose sensitive personal information was involved, the organization has offered complimentary credit monitoring and credit protection services.
To further strengthen its cybersecurity posture, BCHP has implemented additional safeguards designed to protect and monitor its systems against future cyberattacks. The healthcare provider has not revealed the specific measures but noted that the investigation into the breach is ongoing.