Cyber Incident Victim: MultiCare Health System
Date:
Nov 2020
Location:
United States of America
Summary
MultiCare Health System was impacted by a ransomware attack targeting its vendor Netgain Technology, compromising protected health information of over 210,000 patients. The breach exposed sensitive data including vaccination records, workplace injury reports, and safety incident details through systems managed by affiliated healthcare providers.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On November 24, 2020, Netgain Technology LLC experienced a ransomware attack that disrupted services for multiple client organizations, including Tacoma-based MultiCare Health System and its affiliated entities Woodcreek Provider Services and Woodcreek Healthcare. The attackers deployed ransomware to compromise Netgain’s infrastructure, which provided managed IT services to these healthcare organizations. The breach remained under investigation for several weeks as Netgain worked with cybersecurity experts to assess the scope. Forensic analysis confirmed unauthorized actors had accessed and exfiltrated sensitive data from Netgain’s systems during the attack before deploying ransomware. The incident was not publicly disclosed until January 2021 when affected clients began issuing breach notifications.
The compromised data included protected health information (PHI) maintained by MultiCare Health System and Woodcreek entities, impacting over 210,000 patients collectively. Exposed records contained clinical details such as vaccination histories, occupational injury reports, and safety incident documentation. MultiCare and Woodcreek initiated patient notification procedures in early 2021 following confirmation that their data resided on Netgain’s affected systems. No evidence suggested misuse of the stolen information at the time of disclosure. The organizations did not specify operational disruptions to their own systems but emphasized the vendor’s role in the incident. Response efforts focused on forensic reviews, regulatory compliance reporting, and offering credit monitoring services to affected individuals.