Cyber Incident Victim: Johnson Memorial Health
Date:
Mar 2022
Location:
United States of America
Summary
Johnson Memorial Hospital experienced a cybersecurity incident involving unauthorized access to patient data due to a malware infection at its external law firm, Reid and Riege. The breach occurred over several days and exposed personal and protected health information, though specific details regarding compromised data types and the total number of affected individuals remain unclear. The hospital was notified approximately two months after the law firm detected the intrusion, and no misuse of the exposed information had been confirmed at the time of reporting.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 21, 2022, the Hartford, Connecticut-based law firm Reid and Riege detected a security breach involving unauthorized access to its systems. The subsequent forensic investigation confirmed the intrusion persisted until March 27, 2022, during which attackers deployed malware compromising sensitive data. Johnson Memorial Hospital in Stafford Springs, Connecticut—a Trinity Health of New England affiliate—was notified of the incident on May 27, 2022, as the law firm’s compromised systems contained patient personal and protected health information. The hospital’s data exposure stemmed from its association with Reid and Riege, though the specific types of information accessed were not publicly disclosed by either entity. No evidence indicated targeted theft of hospital records, but the malware attack created a pathway for potential exfiltration of identifiable patient details. The investigation did not establish whether attackers actively viewed or extracted hospital-related files during the six-day breach window.
Johnson Memorial Hospital acknowledged the incident but did not disclose remediation measures or identity protection services offered to patients. The scope of impacted individuals remained undetermined at the time of public reporting, with no confirmation of whether Social Security numbers, medical histories, or financial data were among the exposed elements. Reid and Riege’s investigation confirmed the breach timeline but did not attribute the attack to a specific threat actor or motive. No reports of identity theft or fraudulent misuse of hospital patient data were linked to the incident following the law firm’s disclosure. The hospital deferred to Reid and Riege’s oversight of the forensic review without detailing internal security adjustments or coordination with regulatory bodies.