Cyber Incident Victim: Community Health Systems
Date:
Feb 2023
Location:
United States of America
Summary
Community Health Systems experienced a third-party data breach when its vendor Fortra, LLC, provider of the GoAnywhere secure file transfer software, suffered a security incident. The Clop threat actor group exploited a zero-day vulnerability to exfiltrate protected health and personal information of approximately 1 million patients without disrupting healthcare services. This incident resulted in unauthorized disclosure of sensitive data but did not affect patient care delivery.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On or around February 13, 2023, Tennessee-based Community Health Systems, Inc. (CHS) filed an 8-K disclosure with the U.S. Securities and Exchange Commission revealing a data breach impacting approximately one million patients. The breach stemmed from a security incident at Fortra, LLC, a cybersecurity vendor providing CHS affiliates with GoAnywhere secure file transfer software. Fortra notified CHS that attackers exploited a vulnerability in its GoAnywhere platform, resulting in unauthorized access to and exfiltration of protected health information (PHI) and personal information (PI) belonging to CHS patients. The threat actors did not compromise CHS’s internal systems directly but instead targeted the third-party vendor’s file transfer service. CHS clarified the incident did not disrupt patient care delivery despite the exposure of sensitive data governed by HIPAA regulations.
The attackers, identified as the Clop ransomware group by cybersecurity outlet Bleeping Computer, contacted media claiming responsibility for breaching 130 organizations through a zero-day exploit in GoAnywhere. Clop stated their operation focused solely on data theft rather than deploying encryption payloads, indicating a shift from prior ransomware tactics. CHS’s SEC filing provided no technical specifics about Fortra’s vulnerability but confirmed the compromise led to PHI/PI exposure across unnamed affiliates. The healthcare system estimated the breach affected one million individuals, though the exact types of exposed data elements (e.g., names, diagnoses, or financial details) remained undisclosed. Neither CHS nor Fortra provided timelines for detection, containment, or forensic analysis completion in the initial disclosure. As of the filing date, the breach had not been posted to the U.S. Department of Health and Human Services’ public breach portal, suggesting regulatory reporting remained ongoing.