Keystone Health

Summary

A Pennsylvania healthcare provider experienced unauthorized system access potentially compromising patient names, Social Security numbers, and clinical information. The cybersecurity incident disrupted operations and impacted over 235,000 individuals, with the organization issuing breach notifications and offering credit monitoring services to affected patients.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Keystone Health, a Pennsylvania healthcare provider, experienced a cybersecurity incident that compromised patient data and disrupted some systems. The breach was identified on August 19, 2022, prompting an immediate investigation. Forensic analysis revealed unauthorized access to files within Keystone's systems between July 28, 2022, and August 19, 2022. The compromised files contained sensitive patient information including full names, Social Security numbers, and clinical details. While the exact intrusion method remained unspecified, the breach caused operational disruptions across undisclosed systems during the attack window. On October 14, 2022, Keystone publicly disclosed the incident through a website notice and reported to the U.S. Department of Health and Human Services that 235,000 individuals were affected. The investigation confirmed data exposure but did not determine whether ransomware or other attack vectors caused the compromise.

In response, Keystone Health initiated patient notification procedures by mailing individualized breach letters to all impacted individuals. These notifications described the exposed data types and offered complimentary credit monitoring services to mitigate identity theft risks. The organization did not publicly disclose whether it restored systems from backups, implemented new security controls, or paid any ransom demands. No law enforcement updates or attacker attribution details were provided in the initial disclosure. The breach notice confirmed the incident's containment by August 19 but omitted specifics about system restoration timelines or whether third-party forensic investigators assisted with the probe. Clinical operations impacts beyond general "system disruptions" were not detailed in the available reporting.

Sources

Sources available to members: 1 source.