Vista Radiology

Summary

Vista Radiology experienced a ransomware attack that disrupted network operations, initially believed to solely involve system encryption without data compromise. Subsequent investigation revealed unauthorized access to files containing patient information, affecting 3,634 individuals. The organization engaged forensic specialists to address the incident, though specific data types accessed were not detailed in available reports.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On July 11, 2021, Knoxville, Tennessee-based Vista Radiology experienced a ransomware attack that disrupted its operations by taking a portion of its network offline. The organization promptly engaged a leading computer forensics firm to investigate the scope and nature of the incident. Initial findings from the investigation indicated the attackers’ primary objective was system encryption, with no evidence of data exfiltration at that stage. The attack forced Vista Radiology to address immediate operational impacts while forensic analysts worked to determine the extent of network compromise. Security personnel focused on containment measures to prevent further spread of the ransomware across systems.

Four days later on July 15, 2021, the investigation revealed new evidence that files or folders containing patient information had been accessed and viewed during the incident, contradicting earlier assessments about data integrity. This discovery prompted Vista Radiology to initiate breach notification procedures for 3,634 affected patients, though the specific types of compromised data were not disclosed publicly. The organization offered complimentary credit monitoring and identity restoration services to impacted individuals as a remedial measure. Throughout the response, Vista Radiology maintained collaboration with digital forensics experts to finalize the investigation and restore affected systems. The incident highlighted both immediate operational disruption from ransomware encryption and subsequent risks from unauthorized data access.

Sources

Sources available to members: 1 source.