NextGen Healthcare suffered a data breach that impacted +1 Million individuals

NextGen Healthcare suffered a data breach, the security incident exposed the personal information of approximately 1 million individuals.

Healthcare solutions provider NextGen Healthcare suffered a data breach that exposed the personal information of informing approximately one million individuals.

NextGen Healthcare, Inc. is an American software and services company that develops and sells electronic health record (EHR) software and practice management systems to the healthcare industry. NextGen Healthcare also provides population health, financial management, and clinical solutions for medical and dental practices. 

NextGen Healthcare last week notified the Maine Attorney General’s Office and started sending notification letters to the impacted individuals.

The data breach impacted 1049375 individuals, the company has contacted law enforcement and is working with them on the investigation.

According to the letters, the data breach was discovered on April 24, 2023. The company immediately launched an investigation and determined that threat actors had access to the systems at the company between March 29 and April 14, 2023.

“As a result of our detailed analysis of the information impacted, we recently determined that certain of your personal information was included in the electronic data accessed during the incident. Below we have provided information about what information was involved, what we are doing in response, and what you can do to proactively protect yourself.” reads the data breach notification letter. “The personal information contained in the electronic data accessed during the incident included your
name, date of birth, address, and social security number. Importantly, our investigation has revealed no
evidence of any access or impact to any of your health or medical records or any health or medical data.”

The company states that it is not aware of any fraudulent use of the personal information accessed by the intruders.

NextGen Healthcare declared to have taken measures to contain the security breach, including resetting passwords, and further reinforcing the security of its systems.

NextGen Healthcare is also offering impacted individuals 24 months of free fraud detection and identity theft protection through Experian’s IdentityWorks product.

This data breach is likely the second incident suffered by the company this year. On January 19, BlackCat (aka ALPHV) added NextGen to their leak site as reported by DataBreaches.

The NextGen entry was later removed from the leak site of the ransomware gang, but the reason is not clear.

We are in the final!

Please vote for Security Affairs (https://securityaffairs.com/) as the best European Cybersecurity Blogger Awards 2022 – VOTE FOR YOUR WINNERS
Vote for me in the sections where is reported Securityaffairs or my name Pierluigi Paganini

Please nominate Security Affairs as your favorite blog.

Nominate Pierluigi Paganini and Security Affairs here here: https://docs.google.com/forms/d/e/1FAIpQLSepvnj8b7QzMdLh7vWEDQDqohjBUsHyn3x3xRdYGCetwVy2DA/viewform

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, data breach)