Central Ohio Urology Group

Summary

A hacker group identifying as Pravvy Sector publicly released over 150 GB of sensitive data stolen from a urology healthcare provider, exposing extensive patient records containing names, addresses, phone numbers, dates of birth, medical treatments, and insurance details alongside internal financial spreadsheets and human resources documents. The breach impacted numerous individuals, with one elderly patient confirming unauthorized disclosure of his personal information and expressing confusion upon notification, while the affected organization did not respond to initial requests for comment regarding the incident.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On August 2, 2016, a hacker or hacker group identifying as "Pravvy Sector" publicly disclosed a significant data breach involving Central Ohio Urology Group by posting a Twitter link to over 150 GB of stolen data. The compromised information included extensive patient records containing names, addresses, phone numbers, dates of birth, medical treatment details such as renal ultrasounds, sperm counts, and semen analyses, along with insurance provider information. Internal organizational documents were also exposed, including financial spreadsheets and human resources files. The data dump made sensitive records freely accessible without restriction, creating immediate privacy risks for affected individuals. Motherboard verified the authenticity of the data by contacting one impacted patient—an elderly man who expressed confusion and concern upon learning his personal information had been compromised. No technical details regarding the initial intrusion vector, duration of unauthorized access, or security vulnerabilities exploited were disclosed in available reports.

The breach exposed highly sensitive medical and demographic information, potentially affecting numerous patients' privacy and medical confidentiality. Publicly available treatment details could enable targeted harassment or discrimination against individuals based on medical conditions. Financial and HR documents in the leak additionally risked organizational operational security and employee privacy. Central Ohio Urology Group did not issue an immediate public statement regarding the incident, and its IT department failed to respond to Motherboard's requests for comment at the time of reporting. The absence of confirmed containment measures or remediation steps left the full scope of patient impact unaddressed in available documentation. Patients received no verified guidance from the organization about protective actions following the data exposure.

Sources

Sources available to members: 1 source.