Cyber Incident Victim: Mary Free Bed Rehabilitation Hospital
Date:
Mar 2019
Location:
United States of America
Summary
A ransomware incident at Wolverine Solutions Group, a medical billing vendor, compromised sensitive patient data from multiple healthcare providers including Mary Free Bed Rehabilitation Hospital. Approximately 4,755 patients from this institution had private information exposed, alongside tens of thousands from other affected entities such as Covenant, Health Alliance Plan, McLaren, and Spectrum Health Lakeland. The breach occurred due to malware at Wolverine, which delayed notifications for several months while the vendor investigated. The hospital had terminated its contract with the vendor prior to learning of the incident, confirming the decision was unrelated to the security compromise. Other impacted organizations included Sparrow Hospital, North Ottawa Community Health System, Warren General Hospital, and University of Pittsburgh Medical Center Kane.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In March 2019, Mary Free Bed Rehabilitation Hospital disclosed that a ransomware incident at Wolverine Solutions Group, a third-party medical billing vendor, compromised the private information of 4,755 patients. Wolverine Solutions Group confirmed the breach and initiated notification letters to affected individuals. The incident stemmed from a previously reported ransomware attack on Wolverine, which also impacted numerous other healthcare entities across Michigan. Mary Free Bed clarified that its decision to terminate Wolverine’s services predated awareness of the breach, confirming the contractual change was unrelated to the security event. Reports indicated Wolverine’s ransomware incident occurred months earlier, with delayed notifications extending into 2019.
The breach’s scope expanded as additional affected organizations were identified, including Covenant Health (45,000 patients), Health Alliance Plan (120,000 patients), McLaren Health Care (54,000 patients), Sparrow Hospital, North Ottawa Community Health System (15,000 patients), Warren General Hospital, and University of Pittsburgh Medical Center Kane. By mid-March 2019, Spectrum Health Lakeland reported approximately 60,000 potentially impacted patients. Wolverine Solutions Group coordinated notifications across all affected entities, though specific details regarding the ransomware variant, intrusion methods, or data exfiltration were not publicly disclosed. No disruptions to Mary Free Bed’s clinical operations were reported, and the hospital emphasized its reliance on Wolverine for billing services rather than direct patient care systems. The incident highlighted supply-chain risks within healthcare vendor networks, with Wolverine’s breach collectively exposing data across over a dozen providers and hundreds of thousands of patients.