Cyber Incident Victim: Practice Resources
Date:
Apr 2022
Location:
United States of America
Summary
A ransomware attack targeted a New York-based medical billing and practice management company, impacting approximately 942,000 individuals across 26 affiliated healthcare organizations. The incident compromised sensitive data including names, addresses, health plan numbers, treatment dates, and medical record numbers. The organization immediately secured its systems with third-party assistance and implemented cybersecurity enhancements following the attack. Affected individuals were offered credit monitoring services as part of the response efforts.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On April 12, 2022, New York-based medical billing and practice management company Practice Resources, LLC (PRL) experienced a ransomware attack that disrupted operations and compromised sensitive data. PRL immediately secured its systems following the attack and engaged third-party cybersecurity experts to assist with containment and investigation. The incident impacted 26 healthcare organization clients affiliated with PRL, exposing personal and health information of 942,138 individuals. Compromised data included names, addresses, health plan numbers, treatment dates, and medical record numbers. PRL initiated breach notifications through the California Attorney General’s Office, though the exact notification timeline was not specified in the disclosure. The company emphasized its confidential handling of sensitive information and proactive security measures in its public notice.
The attack affected healthcare providers across multiple specialties and regions, including Achieve Physical Therapy, Community Memorial Hospital, Crouse Health Hospital, Syracuse Pediatrics, and Upstate Community Medical among others. PRL implemented immediate cybersecurity enhancements following the incident and announced plans for additional security upgrades. As remediation, the company offered credit monitoring services to affected individuals. No ransomware group was identified in the disclosure, and PRL did not specify whether data was exfiltrated or encrypted. The incident caused operational disruptions for the impacted healthcare clients, though the notice did not detail the duration or specific clinical consequences. PRL’s response focused on system restoration, forensic investigation, and regulatory compliance through patient notifications coordinated with the affected healthcare organizations.