Cyber Incident Victim: Utah Imaging Associates
Date:
Sep 2021
Location:
United States of America
Summary
A healthcare provider experienced a cyberattack compromising sensitive data of approximately 583,600 patients, including names, addresses, dates of birth, Social Security numbers, health insurance details, and medical information such as diagnoses and prescriptions. The breach was detected and halted promptly, with forensic investigation confirming unauthorized access to files used for patient care and administrative purposes. While no misuse of information was reported at notification, the provider implemented enhanced security measures, deployed continuous endpoint monitoring, and offered affected individuals complimentary credit monitoring services as a precaution.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Utah Imaging Associates detected and stopped a cyberattack on September 4, 2021, prompting an immediate forensic investigation with assistance from a specialized third-party cybersecurity firm. The investigation confirmed unauthorized access to files containing sensitive patient information maintained for clinical and administrative purposes. While the specific attack methodology was not disclosed publicly, the forensic review determined the compromised data included first and last names, mailing addresses, dates of birth, Social Security numbers, health insurance policy numbers, and medical details such as treatment records, diagnoses, and prescription information. The scope of the breach impacted 583,643 patients, with variations in the types of exposed data per individual based on their records. No evidence emerged during the investigation suggesting the attackers exfiltrated or misused the accessed data prior to containment.
Utah Imaging Associates initiated patient notifications following the investigation's conclusion, though the exact notification timeline was not specified in available reports. The organization implemented enhanced security measures across its systems and servers, including the deployment of new endpoint monitoring tools designed for continuous intrusion detection. As a precautionary measure despite no confirmed misuse, all affected individuals received offers for complimentary credit monitoring services. The breach notice emphasized the inclusion of Social Security numbers and medical treatment data among the compromised information but did not identify specific systems or network entry points exploited in the attack. Operational impacts beyond data access were not disclosed, and the organization maintained patient care continuity throughout the incident response period.