Cyber Incident Victim: Practice First Medical Management Solutions
Date:
Dec 2020
Location:
United States of America
Summary
A ransomware attack compromised a revenue cycle vendor providing billing services for healthcare organizations, resulting in unauthorized access to sensitive personal and financial information affecting over 1.2 million individuals. The breach involved data including names, Social Security numbers, bank account details, and treatment information. Following detection, the vendor initiated containment measures such as system shutdowns, credential resets, law enforcement engagement, and cybersecurity forensic support. The incident prompted implementation of enhanced security protocols across network, email, and system infrastructure to mitigate future risks.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On December 25, 2020, hackers infiltrated the systems of Practice First Medical Management Solutions, a vendor providing billing and coding services to hospitals and health systems, executing a ransomware attack. The breach remained undetected until December 30, 2020, when the company discovered unauthorized activity involving attempts to exfiltrate files containing sensitive patient and employee information. Upon identifying the intrusion, Practice First immediately initiated containment protocols by shutting down affected systems to halt further unauthorized access. The company also reset account passwords to prevent credential-based attacks and notified law enforcement agencies about the incident. Cybersecurity experts were engaged to assist with forensic analysis and remediation efforts, reflecting a coordinated response to secure compromised infrastructure.
The subsequent investigation confirmed attackers had successfully copied protected health information belonging to 1,210,688 individuals, including patients and employees. Exposed data encompassed names, Social Security numbers, bank account details, and treatment-related information, creating significant risks for identity theft and financial fraud. No evidence suggested actual misuse of the stolen data at the time of disclosure, though the scale of exposed personally identifiable information necessitated breach notifications filed with Maine’s attorney general and other relevant authorities. In response to the incident, Practice First implemented additional security measures across its network infrastructure, email systems, and endpoint devices to strengthen defenses against future attacks. The ransomware incident disrupted the vendor’s revenue cycle operations and underscored systemic vulnerabilities in third-party healthcare service providers, impacting numerous partner organizations reliant on its billing platforms.