Cyber Incident Victim: Jax Spine & Pain Centers
Date:
Jan 2022
Location:
United States of America
Summary
Jax Spine & Pain Centers experienced a ransomware attack targeting an inactive server containing pre-2018 patient demographic data, including names, addresses, dates of birth, and Social Security numbers, though clinical records remained uncompromised. The attackers threatened to publish stolen files unless paid, but the organization prevented server encryption by shutting down the system promptly and confirmed its primary cloud-based network storing post-2018 records was unaffected. They initiated an internal investigation, engaged law enforcement and third-party forensic experts, and are working to identify impacted individuals for notification while continuing operational services.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On January 24, 2022, Jax Spine & Pain Centers experienced a ransomware attack targeting an inactive server storing patient files created prior to May 2018. The attackers compromised a compressed file containing demographic data, including names, addresses, dates of birth, and Social Security numbers for a limited number of individuals, but did not access clinical information or active patient records. The organization's primary cloud-based network server, which housed post-May 2018 patient files, remained unaffected during the incident. Internal security monitoring systems detected unauthorized activity, prompting immediate defensive actions that prevented server encryption. The compromised server was shut down upon discovery of the breach. Attackers issued a ransom threat to publish stolen files unless payment was made, though the notification did not specify whether any ransom was paid.
Jax Spine initiated an internal investigation and notified the FBI of the ransomware attack within hours of detection. The organization engaged third-party forensic investigators to assist in determining the attack's origin and full scope while collaborating with law enforcement agencies. Analysis confirmed the breach exclusively impacted historical records from inactive systems, with no evidence of data exfiltration beyond the pre-2018 demographic information. The clinic began reviewing the compromised data to identify affected individuals for direct notification, though this process remained ongoing at the time of their public statement. Patients treated at Jacksonville or St. Augustine locations prior to May 2018 were advised to monitor financial accounts for unauthorized activity and consider credit monitoring measures through major bureaus. The organization implemented additional security procedures to prevent recurrence but maintained uninterrupted clinical operations throughout the incident response.