Cyber Incident Victim: Jones Eye Clinic and Surgery Center
Date:
Aug 2018
Location:
United States of America
Summary
A ransomware attack encrypted a clinic's network, demanding payment, but data was restored via backups without ransom payment. Over 40,000 patients' protected health information was potentially accessed, including names, addresses, birth dates, medical records, and visit details; some records included Social Security numbers and insurance data. Forensic investigators and the FBI were engaged, confirming electronic medical records remained secure while billing systems were compromised. Enhanced security measures were implemented post-incident, and affected individuals received guidance on mitigating identity theft risks.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On August 23, 2018, staff at Jones Eye Clinic and Surgery Center discovered a ransomware attack had encrypted their computer network during morning operations. The attack impacted systems containing protected health information of patients registered or treated at Jones Eye Clinic or its affiliated CJ Elmwood Partners, L.P. surgery center between January 1, 2003, and the discovery date. Attackers demanded payment to decrypt the files, but the clinic engaged multiple technology companies to restore all affected data using existing backups, avoiding ransom payment. Immediate containment measures included deploying upgraded security protections across the network to block further intrusions. The clinic also initiated forensic investigations with professional computer analysts and reported the incident to the FBI.
Forensic analysis determined that while electronic medical records remained uncompromised, attackers potentially accessed and exfiltrated data from the clinic’s billing and scheduling software. This software contained full names, addresses, dates of birth, service dates, medical record numbers, and general descriptions of patient visits or surgeries for over 40,000 individuals. A subset of records included Social Security numbers, insurance status details, and claims information, though no bank account or credit card data was stored in the affected systems. The clinic mailed individualized notification letters to all impacted patients outlining identity theft prevention steps. Restoration of encrypted data from backups was completed promptly after detection, with no operational disruption reported beyond the initial encryption event. The investigation confirmed the attackers’ access was limited to non-clinical administrative systems during the compromise window.