Cyber Incident Victim: Squirrel Hill Health Center
Date:
Jan 2021
Location:
United States of America
Summary
Squirrel Hill Health Center experienced a cybersecurity incident involving malware that disrupted access to certain files on its network. The malicious activity was detected following suspicious network behavior, with forensic analysis confirming unauthorized access occurred over a one-week period. Compromised information varied but included patient names, addresses, limited appointment details, dates of birth, diagnostic codes, and Social Security numbers for a subset of individuals. The organization engaged third-party specialists to investigate the intrusion and secure affected systems.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On February 4, 2021, Squirrel Hill Health Center detected suspicious activity on its computer network, prompting an immediate investigation with assistance from third-party computer forensic specialists. The investigation determined the network had been infected with malware that prevented access to certain system files. The malicious activity occurred over a seven-day period, beginning on January 28, 2021, and ending on the date of detection. While the specific malware variant was not disclosed, its operational impact involved restricting access to files stored on compromised systems. The forensic analysis confirmed unauthorized access to the network during this timeframe but did not identify evidence of data exfiltration or encryption demands. The center's response focused on containing the malware's spread and assessing the scope of affected systems and data.
The compromised files contained personal and health information that varied by individual, including full names, physical addresses, limited appointment scheduling details, and dates of birth. Diagnostic codes representing medical conditions were also exposed in the incident. A subset of records included Social Security numbers, though the notification specified this sensitive identifier was present only for "a small number of individuals." The health center did not report evidence suggesting actual misuse of the exposed data. No details were provided regarding the number of affected individuals, specific network systems targeted, or remediation measures beyond the initial forensic investigation. The incident timeline indicates a one-week window between initial network compromise and detection of suspicious activity.