OSF HealthCare

Profile narrative

OSF HealthCare System, also referred to as OSF HealthCare or OSF Healthcare, is a healthcare organization based in the United States. While the provided context does not detail the full range of clinical services it provides, the organization's involvement in multiple data security events involving protected health information indicates that it maintains patient records and operates facilities where medical services are delivered. The exposure of ultrasounds, maternity files, pulmonary test results, and medical record numbers in one incident, along with physician names, service departments, and treatment locations in another, suggests that the organization functions across multiple care settings and maintains relationships with both patients and clinical staff. Filenames in the leaked data referenced patient identifiers, further confirming the organization's role in maintaining identifiable health records for the individuals it serves.

The organization has experienced at least three significant cybersecurity incidents between 2020 and 2021, placing it among the healthcare entities affected by evolving ransomware and third-party supply chain threats during that period. A 2020 ransomware attack on Blackbaud, a third-party service provider, compromised patient information including names, contact details, dates of birth, treatment locations, physician names, service departments, room numbers, and medical record numbers; OSF HealthCare was part of a broader compromise that affected over 10 million patients across multiple organizations. In April 2021, the organization discovered a ransomware attack on its own systems and determined that protected health information of more than fifty thousand individuals had been exfiltrated, resulting in a delayed notification that prompted an Office for Civil Rights investigation and a settlement of five hundred fifty-two thousand two hundred fifty dollars alongside a corrective action plan. A separate 2021 incident attributed to the Xing Team ransomware group resulted in the exfiltration and public release of 112 GB of data, including over 516,000 images, though the organization did not publicly acknowledge the event at the time of reporting.

OSF HealthCare operates as a regulated entity subject to the HIPAA Breach Notification Rule, as evidenced by the regulatory scrutiny following its delayed notification of the April 2021 ransomware attack. The organization's breach disclosures reference patients in Illinois and Michigan, indicating a multi-state footprint within the U.S. healthcare sector. Its reliance on third-party service providers, demonstrated by the Blackbaud incident, highlights a structural dependency on external vendors for data management functions. Across these incidents, the types of data compromised—patient records, staff information, emails, contracts, and financial details—suggest that the organization handles both clinical and administrative information across multiple departments and facilities.

Incidents

3 incidents linked to this organisation.