Cyber Incident Victim: Sentara Healthcare
Date:
Nov 2016
Location:
United States of America
Summary
A cybersecurity breach at a third-party vendor compromised records of over 5,400 vascular and thoracic patients treated at Sentara Healthcare facilities, exposing names, medical record numbers, dates of birth, Social Security numbers, procedure details, demographic information, and medications. The organization collaborated with law enforcement and its information security team to investigate the incident involving unauthorized access to patient data, though the exact nature—whether external attack or insider misconduct—remained unclear. Notification letters were mailed to affected individuals, accompanied by a dedicated call center for inquiries, while authorities continued their investigation into the vendor's security failure. The breach exclusively impacted specific patients from a limited treatment period and specialty care areas.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On November 17, 2016, Sentara Healthcare, in coordination with law enforcement, identified a cybersecurity incident involving one of its third-party vendors. The breach compromised records of 5,454 vascular and thoracic surgery patients treated at Sentara hospitals in Virginia between 2012 and 2015. Exposed information included patient names, medical record numbers, dates of birth, Social Security numbers, procedure details, demographic data, and medication information. Sentara's Information Security team, the unnamed vendor, and law enforcement jointly investigated the incident, which remained active at the time of public disclosure. The organization confirmed the breach did not impact all Stronga Healthcare patients, only those receiving specific surgical care during the three-year window. No technical details regarding attack vectors, system compromises, or intrusion methods were disclosed publicly.
Sentara initiated patient notifications on January 13, 2017, mailing letters to affected individuals and establishing a dedicated call center operational Monday through Friday. Recipients were instructed to contact Sentara by January 29, 2017 if they suspected involvement but hadn't received correspondence. The healthcare provider advised vigilance against identity theft through monitoring financial accounts and reviewing credit reports, though no evidence of data misuse was confirmed. Law enforcement involvement continued during the notification phase, restricting Sentara's ability to disclose specifics about the breach's origin or whether it resulted from external attacks or insider actions. The incident highlighted risks associated with third-party vendor relationships in healthcare data management, though no operational disruptions or additional impacted services were reported.