Cyber Incident Victim: Peak TPA
Date:
Dec 2020
Location:
United States of America
Summary
A ransomware attack compromised participant data managed by healthcare services provider PeakTPA, impacting St. Bernards Total Life Healthcare. PeakTPA notified the affected entity of the breach, which involved unauthorized access to patient information. The incident was reported to federal regulators as affecting approximately 50,000 individuals, though the exact scope—whether limited to a single entity or spanning multiple clients—remained unclear. The attacker deployed ransomware, but the specific variant was not disclosed publicly. The breach prompted inquiries seeking clarification on the scale of impacted patients and technical details, though no additional information was available at the time of reporting.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On December 28, 2020, a ransomware attack compromised participant data held by St. Bernards Total Life Healthcare, Inc. (TLH), a healthcare provider. PeakTPA, a third-party healthcare management services provider responsible for handling TLH’s data, discovered the breach and formally notified TLH of the incident on January 23, 2021. The attack occurred on or around the initial December date, though the specific ransomware variant involved remained unidentified in public disclosures. TLH’s HIPAA Privacy Officer, Daya S. Shipman, confirmed the breach through a media release, acknowledging the unauthorized access to protected health information. The delayed notification timeline—nearly one month between the attack’s occurrence and PeakTPA’s alert to TLH—suggests a period of investigation or containment efforts prior to stakeholder communication.
PeakTPA reported the incident to the U.S. Department of Health and Human Services (HHS) on March 2, 2021, listing the breach as affecting approximately 50,000 individuals. However, the scope of this figure was ambiguous, as PeakTPA did not clarify whether it represented TLH patients exclusively or included individuals from other healthcare entities serviced by the company. DataBreaches.net sought clarification from PeakTPA regarding the patient count’s applicability and the ransomware strain involved but received no response prior to the article’s publication. The breach exposed sensitive participant data managed by TLH, though specific details about the compromised data categories—such as medical records, insurance details, or identifiers—were not disclosed publicly. The incident underscored risks associated with third-party vendor dependencies in healthcare data management, particularly regarding ransomware threats targeting administrative service providers. No additional mitigation actions or containment measures by either TLH or PeakTPA were detailed in the available reporting.