Cyber Incident Victim: Reconstructive Orthopedic Center
Date:
Sep 2020
Location:
United States of America
Summary
The Reconstructive Orthopedic Center suffered a ransomware attack by DoppelPaymer threat actors, resulting in significant exfiltration of protected health information including detailed medical records, therapy files, insurance billing data, and attorney communications related to injury or workers' compensation cases. A partial data dump revealed thousands of scanned patient documents containing personally identifiable and health information, with some records displaying truncated Social Security numbers, though the full scope of compromised data remains unclear as the organization had not publicly acknowledged the incident or responded to inquiries at the time of reporting.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In September 2020, the Reconstructive Orthopedic Center (ROC), a Houston-based medical practice, suffered a cybersecurity incident involving the DoppelPaymer ransomware group. Attackers infiltrated ROC's systems and exfiltrated a significant volume of protected health information (PHI) prior to or on September 16, as evidenced by timestamps in subsequently leaked files. The threat actors publicly disclosed their attack on November 17 by adding ROC to their dedicated data leak site and releasing a partial dataset containing thousands of scanned patient records. The compromised information included detailed medical histories, therapy documentation, insurance billing data, attorney communications related to injury and workers' compensation cases, and personally identifiable information (PII) such as names, addresses, and truncated Social Security numbers. Notably, one sample file contained 131 pages of faxed medical records pertaining to an individual patient, illustrating the depth of clinical information exposed.
The attackers' data dump revealed systemic access to ROC's document repositories, though the full scope of exfiltrated records remained unconfirmed at the time of reporting. While many files showed redacted Social Security numbers, the cumulative PHI exposure posed substantial privacy risks given the inclusion of treatment details, legal correspondence, and financial information. ROC had not issued public statements about the breach or posted notifications on their website as of November 19, 2020, and failed to respond to multiple inquiries regarding the incident. The presence of pre-2020 records in the leak suggested potential exposure of historical patient data, raising concerns about the breach's ultimate magnitude if earlier records were compromised. Security analysts monitoring the situation noted the operational disruption and reputational damage stemming from the unauthorized access and subsequent publication of sensitive medical documentation.