Mackay Memorial Hospital

Summary

A notable medical institution experienced a cybersecurity incident when patient personal data was reportedly leaked and offered for sale on the dark web by a threat actor. The facility confirmed the breach, stating that an investigation into the matter had already been initiated. The exposed information reportedly included sensitive patient records, prompting serious privacy and security concerns. The incident is currently under examination as authorities and the institution work to determine the full scope of the compromise and identify the responsible party.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On 2025-02-09, a Yahoo News article was published under report identifier 98a6c0c0-b81a-4aea-ba85-9ae4f3dff93f referencing Mackay Memorial Hospital and the alleged unauthorized sale of patient data, indicating that the hospital had entered an investigation procedure. Beyond this headline-level indication, the body of the article provided in the source material contains no further substantive details about the incident. The textual content of the source consists entirely of a standard Yahoo cookie-consent and privacy-settings preamble, which describes the Yahoo family of brands, the operation of Yahoo and AOL sites and apps, the Yahoo Advertising service, and the options available to users to "Reject all," "Manage privacy settings," or revisit choices through the "Privacy & cookie settings" or "Privacy dashboard" links. No facts regarding the nature of the data exposure, the date(s) on which unauthorized activity began, the systems affected, the number of patients impacted, the threat actor or method of compromise, the discovery timeline, the containment actions taken, or the regulatory notifications issued are present in the supplied evidence.

Because the only verifiable incident-related fact supplied is the article's publication date and the assertion that the hospital had initiated an investigation following reports that patient data had been offered for sale, a comprehensive narrative chronology cannot be constructed without fabricating specifics. The available material does not confirm when the alleged data was first exposed, how it was obtained, which departments or information systems were involved, what categories of personal or medical information were implicated, whether ransomware, insider misuse, third-party vendor compromise, or another vector was responsible, how the hospital became aware of the listing, or what containment, eradication, or recovery steps were undertaken. It likewise does not specify whether law enforcement, the Taiwan Personal Data Protection Act authorities, or sector regulators were contacted, nor does it detail any patient notifications, credit-monitoring offerings, or operational disruptions to clinical services. No impacted-record count, no timeline of attacker dwell time, and no description of forensic findings can be drawn from the source.

What can be stated with certainty is limited to the following: a media report dated 9 February 2025 described a situation in which patient information associated with Mackay Memorial Hospital was allegedly advertised for sale by an actor, and the hospital's official position, as reported, was that an investigative process had been commenced. The remainder of the observable content in the provided source is generic platform boilerplate relating to data-use choices and does not contribute additional incident facts. Any further narrative elaboration beyond these confirmed points would constitute speculation, which the task constraints explicitly prohibit, and so the account must remain concise and confined to what the source directly supports.

Sources

Sources available to members: 0 sources.