FPS Medical Center

Summary

A ransomware attack compromised FPS Medical Center's systems, potentially exposing data of 28,024 patients. The attacker accessed the network days before deploying malware that encrypted files, with investigations unable to confirm whether patient information was viewed or exfiltrated. Impacted data included contact details, driver’s licenses, treatment and diagnosis information, health insurance data, and Social Security numbers for a limited subset. The organization restored affected systems and initiated a review of its security policies while implementing additional administrative and technical safeguards to prevent future incidents.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

The ransomware incident impacting FPS Medical Center began on February 28, 2022, when an unauthorized actor first gained access to the organization's network. Four days later, on March 3, 2022, the attacker deployed malware that encrypted data stored on certain FPS systems. This encryption prompted immediate containment measures, including system restoration efforts to recover operational capabilities. FPS initiated a forensic investigation to determine the scope of compromise, which confirmed the initial intrusion date and the subsequent encryption event. The investigation could not conclusively establish whether the attacker viewed or exfiltrated patient data during the four-day access period prior to encryption. As a precautionary measure, FPS determined that 28,024 patients had potentially exposed information and issued breach notifications to these individuals.

The potentially compromised data included patient contact information, driver's license details, medical treatment records, diagnosis information, and health insurance data. A limited subset of patients also had their Social Security numbers exposed. FPS completed system restoration following the encryption event but maintained uncertainty regarding data accessibility during the attacker's network presence. In response to the incident, the organization began reviewing existing security policies and procedures while implementing additional administrative and technical safeguards. No evidence confirmed data misuse, but the inability to rule out access during the intrusion window necessitated patient notifications. The forensic timeline established clear boundaries for the network access period, though the specific methods of initial compromise remained unspecified in public disclosures.

Sources

Sources available to members: 1 source.