Cyber Incident Victim: University Medical Center
Date:
Jun 2021
Location:
United States of America
Summary
University Medical Center experienced a cybersecurity breach in mid-June when hackers accessed a data server containing personal information, leading to the online exposure of documents such as driver’s licenses, passports, and Social Security cards belonging to some individuals. The nonprofit hospital confirmed no clinical systems were compromised and is notifying potentially affected patients and employees while offering identity protection services. Law enforcement is investigating the incident, which has been linked by cybersecurity analysts to a group associated with high-profile ransomware attacks targeting healthcare providers.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
In mid-June 2021, University Medical Center (UMC), a nonprofit public hospital in Las Vegas, Nevada, experienced a cybersecurity breach involving unauthorized access to a data server. The hospital confirmed the incident after a hacking group publicly posted images of stolen personal information online. According to UMC’s statement, cybercriminals breached a server used for data storage, but there was no evidence of compromise to clinical systems or patient care infrastructure. Law enforcement agencies were notified and initiated an investigation into the breach. The hospital began notifying affected patients and employees that their personal information might have been exposed, though the full scope of the breach was not immediately disclosed. UMC committed to offering identity protection and credit monitoring services to those potentially impacted. The breach was first publicly acknowledged in a June 29, 2021, statement following media reports about the hackers’ actions.
The hacking group responsible posted images of sensitive documents, including driver’s licenses, passports, and Social Security cards belonging to approximately half a dozen individuals on its website on June 28, 2021. Cybersecurity threat analyst Brett Callow linked the group to previous high-profile ransomware incidents, noting that 32 healthcare providers had been targeted by ransomware attacks in 2021 alone. UMC emphasized that its response included securing systems, assessing the extent of the breach, and cooperating with law enforcement. The hospital did not confirm whether ransomware was deployed or whether data was exfiltrated beyond the samples displayed by the attackers. No disruptions to medical services or compromises to clinical operations were reported. The incident highlighted risks to non-clinical data systems within healthcare organizations, particularly those storing personally identifiable information.