Nearly 300,000 patients potentially affected by incident reported in late June as malware attack compromises sensitive data
Houston-based Benefit Recovery Specialists, which provides billing and collection services to healthcare providers and payers, recently began notifying 274,837 patients and health plan members of a malware attack that compromised their protected health information.
“On April 30, 2020, we discovered a malware incident impacting certain company systems,” read the notification letter. “Upon learning of this, we immediately began an internal investigation and took the affected systems offline to remove the malware and ensure the security of the BRSI environment. We also began working with third-party cybersecurity specialists to determine the full scope and nature of the event and notified federal law enforcement.”
After discovering the cyberattack on April 30 they launched an investigation, which found that an unauthorized user accessed BRSI’s systems using employee credentials and deployed malware. The hacker had access to certain BRSI customer files containing personal information between April 20-30.
The investigation concluded on or about May 29, 2020 and confirmed that an unauthorized actor accessed BRSI’s systems using employee credentials and deployed malware within BRSI’s environment. The investigation further revealed that certain BRSI customer files containing personal information may have been accessed and/or acquired by the unknown actor between April 20, 2020 and April 30, 2020. We worked with the cybersecurity team to perform a comprehensive review of the files that may have been accessible to the unauthorized actor to determine the exact personal information impacted by this event.
Personal information impacted by the malware attack includes names, dates of birth, policy identification numbers, provider names and, for a small number of individuals, Social Security numbers.
BRSI began notifying affected individuals June 2, reporting the incident on June 26 to HHS as affecting 274,837 individuals.