Vantage Healthcare Network

Summary

Vantage Healthcare Network experienced a ransomware attack compromising systems used by Allegheny Health Network Home Infusion, resulting in unauthorized access and exfiltration of sensitive patient information including names, billing details, medical records, and a limited number of Social Security numbers. The incident impacted approximately 7,500 individuals, with the vendor restoring encrypted data and offering credit monitoring services for affected patients; no evidence of data misuse has been identified. Separately, Jefferson Health reported unauthorized access to a billing portal exposing treatment and payment details for over 8,700 patients across two hospitals, though no financial or insurance information was compromised.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On October 17, 2021, Vantage Healthcare Network detected suspicious activity within its network, prompting an investigation with a third-party cybersecurity firm. The investigation revealed a ransomware attack involving unauthorized access to systems containing patient data from Allegheny Health Network Home Infusion, a Pittsburgh-based entity utilizing Vantage’s services. Attackers exfiltrated data prior to encrypting files, though the specific intrusion vector remained unspecified. AHN Home Infusion was notified of the breach by Vantage on November 22, 2021, after investigators confirmed both data access and exfiltration. A collaborative investigation between AHN Home Infusion and Vantage identified compromised data types, including patient names, billing information, nurse’s notes, referral details, prescriptions, treatment/therapy records, medical device orders, scheduling information, and a limited subset of Social Security numbers. The breach impacted 7,500 individuals, as reported to the HHS Office for Civil Rights. No evidence emerged suggesting misuse of the exfiltrated data during or after the investigation period documented in the source material.

Vantage Healthcare Network restored all encrypted data from backups following the attack. Mitigation efforts included offering complimentary credit monitoring services to individuals whose Social Security numbers were exposed, though the exact number of affected SSNs was not quantified in available reports. AHN Home Infusion continued reviewing documents to finalize the scope of compromised records, emphasizing no operational disruptions beyond data access. The breach notification process proceeded without explicit mention of regulatory fines or legal actions in the disclosed timeline. Security protocol enhancements were implied but not detailed beyond Vantage’s restoration of systems and AHN Home Infusion’s ongoing review. Jefferson Health’s unrelated November 2021 portal breach involving payment diversion attempts was resolved separately, with no overlap in systems or patient datasets affected in the Vantage incident.

Sources

Sources available to members: 1 source.