MultiCare Health System
Incident posture
Linked entities
- Victim
- MultiCare Health System
- Threat actors
- 0 actors
- Sources
- 1 source
Timeline
Summary
MultiCare Health System was impacted by a ransomware attack targeting its vendor Netgain Technology, compromising protected health information of over 210,000 patients. The breach exposed sensitive data including vaccination records, workplace injury reports, and safety incident details through systems managed by affiliated healthcare providers.
Motives
Detailed motive labels are available to members.
TTPs
Detailed technique labels are available to members.
Description
On November 24, 2020, Netgain Technology LLC experienced a ransomware attack that disrupted services for multiple client organizations, including Tacoma-based MultiCare Health System and its affiliated entities Woodcreek Provider Services and Woodcreek Healthcare. The attackers deployed ransomware to compromise Netgain’s infrastructure, which provided managed IT services to these healthcare organizations. The breach remained under investigation for several weeks as Netgain worked with cybersecurity experts to assess the scope. Forensic analysis confirmed unauthorized actors had accessed and exfiltrated sensitive data from Netgain’s systems during the attack before deploying ransomware. The incident was not publicly disclosed until January 2021 when affected clients began issuing breach notifications.
The compromised data included protected health information (PHI) maintained by MultiCare Health System and Woodcreek entities, impacting over 210,000 patients collectively. Exposed records contained clinical details such as vaccination histories, occupational injury reports, and safety incident documentation. MultiCare and Woodcreek initiated patient notification procedures in early 2021 following confirmation that their data resided on Netgain’s affected systems. No evidence suggested misuse of the stolen information at the time of disclosure. The organizations did not specify operational disruptions to their own systems but emphasized the vendor’s role in the incident. Response efforts focused on forensic reviews, regulatory compliance reporting, and offering credit monitoring services to affected individuals.
Sources
Sources available to members: 1 source.