Cyber Incident Victim: Retinal Consultants Medical Group
Date:
Jul 2021
Location:
United States of America
Summary
Retinal Consultants Medical Group experienced a sophisticated cyberattack that disrupted services and potentially compromised sensitive patient information, including names, addresses, medical conditions, and financial data. While unauthorized network access was confirmed, the organization could not definitively determine whether data was exfiltrated. Affected individuals were notified several months after the incident and offered complimentary credit monitoring services as a precautionary measure. The breach prompted an internal investigation and collaboration with cybersecurity experts to address vulnerabilities.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Retinal Consultants Medical Group, operating as Vitreo-Retinal Medical Group Inc., detected a sophisticated cyberattack on or around July 12, 2021, which disrupted its services. The incident involved unauthorized access to the organization's network, potentially compromising sensitive patient information. Exposed data included names, addresses, dates of birth, medical condition details, and financial information. The medical group confirmed the breach resulted in service interruptions but could not definitively establish whether attackers actually exfiltrated patient data from their systems. Notification letters to affected individuals commenced on November 9, 2021—nearly four months after initial detection—indicating a prolonged investigation period. The delayed notification timeline suggests complexities in determining the full scope of compromised information across their systems.
In response to the breach, Retinal Consultants Medical Group initiated credit monitoring services for impacted patients as a protective measure against potential identity theft or financial fraud. The organization did not publicly specify containment actions taken during the incident response but acknowledged the involvement of cybersecurity professionals in investigating the attack. No ransomware component was explicitly mentioned in their disclosure, distinguishing it from the contemporaneous Three Rivers Regional Commission attack detailed in the same report. The medical group's public statement emphasized the sophistication of the attack while maintaining uncertainty regarding data theft, reflecting challenges in forensic analysis common to network intrusions. Service restoration timelines and specific technical mitigations implemented post-incident were not disclosed in available reporting.