Pediatric mental health provider Brightline has warned patients that it suffered a data breach on January 30, affecting 783,606 people.
Writing in a notice on its website earlier this week, Brightline said the breach was related to a zero-day vulnerability in its secure Fortra GoAnywhere MFT file sharing platform.
“Through its investigation, Fortra claims to have identified a previously unknown vulnerability that an unauthorized party used to access certain Fortra customer accounts and download files, including ours,” the notice says.
Brightline said its investigation determined the incident was limited to the Fortra service and did not affect its network. However, the data stolen in the breach included confidential patient information.
“[This] potentially [includes] some combination of the following data elements: individual names, addresses, dates of birth, member identification numbers, date of health plan coverage, and/or employer names,” the company wrote.
According to Bleeping Computer, these attacks were carried out by the Clop ransomware gang using the command injection vulnerability CVE-2023-0669.
Read more about the vulnerability and Clop here: Clop Ransomware Group Exploits GoAnywhere MFT Flaw
“The fact that the Clop ransomware gang was able to maintain compromise on Brightline environments for months, even after publishing Brightline on its portal, is very telling of the current state of information security in the industry healthcare,” commented David Benas, an associate. principal consultant for the Synopsys Software Integrity Group.
“While proactive protection against vulnerabilities is critically important, this incident demonstrates that demonstrating that you have a strong pre-breach incident response capability is just as important, if not more important, in a situation like this.”
Echoing Benas’ point, James Graham, vice president of RiskLens, said that members of the healthcare industry are often targeted by threat actors, which means that healthcare organizations must be exceptionally secure against their investments in cyber security.
“Part of this is performing quantitative risk assessments using the FAIR standard to provide an overview of risk in terms of probability and cost, allowing security investments to be made more efficiently.”
Source link
The recent hack of Brightline has exposed the personal health data of over 780,000 child mental health patients, a shocking reminder of the fragility of sensitive information in our increasingly digital world. Founded in 2016, Brightline specializes in providing connected mental health services for children, helping to bridge the gap between in-person clinics and virtual service.
This hack exposes the need for secure and optimized data security measures, especially when it comes to dealing with sensitive and vulnerable patient data. As a full-stack tech company with years of data security experience, Ikaroa is deeply dedicated to helping companies secure their data against increasingly sophisticated and targeted cyberattacks. By keeping customer data safe, Ikaroa is helping ensure that vulnerable populations are not put at risk of having their private information compromised.
We at Ikaroa understand the importance of protecting data so that privacy is respected and maintained. That is why we dedicate ourselves to offering secure, reliable, and intuitive security products and services, so companies have the tools they need to protect their data, no matter what the circumstance.
Ultimately, protecting customer data is paramount for all businesses, no matter the industry. Through years of experience and working with organizations across a range of sectors, Ikaroa knows that data security is a continuous effort that should always be kept in mind. This incident further highlights the need for reliable and innovative data protection tools, which is one more reason why at Ikaroa, we are committed to helping protect data and secure data of all kinds to minimize the risk of a data breach.
