Cyber Incident Victim: Surgical Dermatology Group
Date:
Mar 2017
Location:
United States of America
Summary
A cybersecurity incident at Surgical Dermatology Group's cloud hosting provider allowed unauthorized access to patient data, including names, contact details, Social Security numbers, medical record identifiers, insurance information, and service payment records. The breach occurred over a period before being detected and terminated by the provider. While no evidence of misuse was found, the practice notified affected individuals, offering complimentary credit monitoring and identity theft protection services. They engaged third-party forensic investigators, contacted law enforcement, and implemented additional security measures to safeguard patient information.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 3 motives | 3 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On June 7, 2017, Surgical Dermatology Group (SDG) in Birmingham, Alabama, was notified by its cloud hosting and server management provider, TekLinks, Inc., of a security breach at TekLinks' Birmingham facility hosting SDG's server. The external hackers had potentially gained initial access as early as March 23, 2017. TekLinks confirmed unauthorized access was terminated by May 1, 2017, with monitoring from April 22 through May 1 revealing no further malicious activity during that period. SDG immediately launched an investigation assisted by third-party forensic experts to assess the incident’s scope and verify server security. The investigation focused on identifying compromised data and reinforcing system integrity. SDG also engaged the Federal Bureau of Investigation and implemented additional safeguards to protect patient information.
The breach exposed sensitive patient data including names, addresses, telephone numbers, email addresses, Social Security numbers, medical record numbers, patient IDs, physician names, health insurance details, and service charge/payment records. No driver’s licenses, credit card information, or other financial data was stored on the affected server. Although no evidence of actual or attempted misuse was found, SDG issued notifications due to the data’s sensitivity. Affected individuals received letters outlining the incident and instructions to enroll in complimentary credit monitoring and identity theft protection services for one year. A dedicated toll-free helpline (1-888-451-6562) was established for inquiries, and SDG committed to posting updates on its website. The organization publicly apologized for the incident, emphasizing its commitment to patient privacy and regret over the disruption caused.