Cyber Incident Victim: Peachtree Neurological Clinic
Date:
Feb 2016
Location:
United States of America
Summary
Peachtree Neurological Clinic experienced two cybersecurity incidents involving unauthorized system access. A ransomware attack encrypted their electronic medical records, which were restored from backups without ransom payment; no data exfiltration was confirmed. During this investigation, an older breach was discovered where unauthorized individuals accessed systems over an extended period, potentially exposing patient names, contact details, Social Security numbers, dates of birth, driver's license information, treatment details, prescriptions, and insurance data. While the clinic found no evidence of actual data access or theft in either incident, it notified potentially affected individuals, offered identity theft protection services, and reported the events to law enforcement. The organization emphasized its commitment to patient privacy amid these criminal acts.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Peachtree Neurological Clinic (PNC) experienced two distinct cybersecurity incidents discovered through a ransomware investigation in 2017. The clinic's electronic medical records (EMR) system was encrypted by a ransomware virus that demanded payment for file decryption. PNC refused to pay the ransom and instead restored system functionality using backup records, maintaining uninterrupted patient care throughout the incident. Post-incident scans detected no residual ransomware presence, and investigators found no evidence of data exfiltration during this encryption event. However, the ransomware investigation revealed a separate, previously undetected unauthorized access incident. Unidentified individuals had infiltrated PNC's systems between February 2016 and May 2017 without the clinic's knowledge, establishing prolonged access to their network infrastructure.
The historical breach exposed potential access to sensitive patient information including names, addresses, telephone numbers, Social Security numbers, dates of birth, driver's license numbers, treatment details, prescription records, and health insurance information. While PNC could not confirm whether attackers actually viewed or extracted specific data, forensic analysis verified unauthorized system access had occurred. The clinic notified all potentially affected patients about both security events as a precautionary measure, offering complimentary identity theft protection services. PNC reported the incidents to law enforcement authorities and committed to cooperating with investigations. The dual disclosure highlighted security vulnerabilities across different time periods, with the ransomware incident serving as the detection mechanism for the older compromise. Clinic management publicly acknowledged the breaches and expressed regret for potential patient concerns while maintaining treatment operations throughout both events.