Crooks get their hands on 500K+ radiology patients' records in cyber-attack

Consulting Radiologists has notified almost 512,000 patients that digital intruders accessed their personal and medical information during a February cyberattack.

The 90-year-old Minnesota-based healthcare biz provides on-site radiology services for 22 hospitals and clinics, plus remote teleradiology for more than 100 facilities in upper Midwest America.

According to a privacy breach notification filed with the Maine Attorney General, the physician-owned operation spotted suspicious activity on its network on February 12, and shortly after "learned that an unauthorized actor accessed certain files and data stored within our network."

This included patients' names, addresses, dates of birth, Social Security numbers, and health insurance information and medical records, all belonging to 511,947 people.

"At this time, we have no evidence any of the information has been misused by a third party, but because information related to you was disclosed, we are notifying you out of full transparency," the radiology firm told patients in a notification letter [PDF]. 

As part of its incident response, the business hired a cybersecurity outfit to assist in its investigation, and deployed "additional monitoring tools" while it takes steps to "enhance the security of our systems." It's also offering affected individuals 12 months of free credit monitoring services.

Consulting Radiologists did not immediately respond to The Register's questions about the break-in, including how the data thieves gained access to its network, if they demanded a ransom payment, and what additional security measures have been added to better protect patients' files.

Two ransomware crews, LockBit and Qilin, both claimed in April to have stolen Consulting Radiologists' data. Russia-based Qilin claimed to have made off with more than 70GB, covering 94,667 files. This is the same gang behind the Synnovis ransomware attack, which continues to cause a healthcare crisis at London hospitals.

Synnovis is a partnership between pathology services company Synlab Group and two London NHS Trusts, and in an interview with The Register, the ransomware crew said it has no regrets targeting critical services organization.

A spokesperson for the criminals said that attack was politically motivated, and when asked if they figured a healthcare crisis in the capital city would ensue, said: "Yes, we knew that. That was our goal." ®