Cyber Incident Victim: Preferred Home Care of New York
Date:
Jan 2021
Location:
United States of America
Summary
A New York-based home care agency experienced a ransomware attack by Sodinokibi (REvil) threat actors, leading to unauthorized access of sensitive data affecting over 92,000 individuals. The compromised information included names, contact details, demographic data, financial account numbers, Social Security numbers, and medical records such as health assessments, vaccination records, and compensation claims. The attackers initially posted proof of access on their dark web leak site but did not release additional data. The organization discovered the breach one day after its occurrence and later notified impacted individuals, offering complimentary credit monitoring services. While acknowledging the incident, the agency stated no evidence of information misuse and suggested the attackers' primary motive was not personal data exploitation.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On January 8, 2021, Preferred Home Care of New York experienced a ransomware attack attributed to the Sodinokibi (REvil) threat actors. The breach was discovered by the agency on January 9. The attackers subsequently added Preferred Home Care to their dark web leak site, where they published screenshots demonstrating unauthorized access to the agency's systems. These screenshots included directory structures and images of employee identification cards, though no full data dump was released beyond this initial proof-of-access material. The agency did not publicly acknowledge the incident or respond to inquiries from DataBreaches.net on January 26 regarding the attackers' claims.
External counsel for Preferred Home Care submitted a breach notification letter to affected individuals on March 10, 2021, confirming the January 8 intrusion. The compromised data varied by individual but potentially included names, contact details, dates of birth, bank account numbers, Social Security numbers, and medical information related to health assessments, drug screenings, vaccinations, and employment-related claims. A total of 92,283 individuals were notified of the exposure. In the notification letter, Administrator Allen Hymowitz stated the organization had no evidence of fraudulent activity resulting from the breach and suggested data misuse was not the attackers' primary objective. Despite this assessment, the agency offered affected individuals a complimentary one-year subscription to Experian IdentityWorks credit monitoring services. The threat actors did not release additional stolen data following their initial January postings, and Preferred Home Care maintained no further public communication about the incident despite repeated media inquiries.