Cyber Incident Victim: Dr. DeLuca and Dr. Marciano Eye Associates
Date:
Jan 2019
Location:
United States of America
Summary
A ransomware attack compromised the data of nearly 24,000 patients at an eye care practice. The organization restored its systems using backups without paying the ransom, and its cyberinsurance policy covered costs associated with notifying affected individuals. The incident was reported to federal health authorities.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On or around January 25, 2019, Dr. DeLuca & Dr. Marciano Eye Associates, a Connecticut-based medical practice, experienced a ransomware attack that encrypted their systems and disrupted operations. The attackers demanded payment to restore access to the compromised data. The practice did not comply with the ransom demand, instead relying on existing backups to restore their systems. This restoration process allowed them to regain operational functionality without negotiating with the threat actors. The incident was reported to the U.S. Department of Health and Human Services (HHS) as affecting 23,578 individuals, indicating the attackers potentially accessed or encrypted protected health information during the breach.
The practice initiated patient notification procedures following the system restoration, issuing formal communications to nearly 24,000 affected individuals. Their cyberinsurance policy covered costs associated with breach notifications and related incident response activities. While the specific ransomware variant and initial attack vector were not publicly disclosed, the incident highlighted the operational resilience provided by maintained backups. No evidence suggested public data leaks or additional malicious activity following the restoration. The attack’s primary consequences involved temporary operational disruption, notification obligations, and potential exposure of patient health information, though no long-term data misuse was confirmed in available reports.