A ransomware attack on Medicaid billing company Timberline Billing Service, LLC based in Des Moines, IA resulted in file encryption with prior data theft.
The investigators of the attack confirmed that an unidentified person acquired access to its systems from February 12, 2020 to March 4, 2020 and installed ransomware. Before encrypting files, the attacker exfiltrated selected information from its systems.
Timberline has clients consisting of about 190 schools in Iowa. It has already notified the affected school districts in the state about the breach. Currently, the exact number of schools affected by the breach is still unclear. There is also no confirmation if the breach only affected schools in Iowa as Timberline likewise has offices in Illinois and Kansas.
The attacker potentially obtained the following types of data: names, birth dates, billing details and Medicaid ID numbers. The Social Security numbers of a limited number of clients were likewise potentially compromised. Although data theft was confirmed by the investigators, there is no report received yet that indicates data misuse.
Timberline has reported the breach to the Department of Health and Human Services’ Office for Civil Rights and indicated that 116,131 people
were affected.
PHI Breach at University of California San Francisco
A cyberattack on the University of California San Francisco (UCSF) led to the potential compromise of personal and health data kept by the UCSF School of Medicine. UCSF discovered the cyberattack on June 1, 2020, which affected a minimal part of the IT systems of the School of Medicine. There was no other information provided regarding the precise nature of the attack.
A top cybersecurity expert assisted with the investigation and confirmed the compromise of the records associated with present and past UCSF students, employees, collaborators, and research contributors. Those data included names, government ID numbers, medical data, medical insurance details, Social Security numbers, and some financial data. UCSF states that it does not know of any cases of personal data misuse.
UCSF has called in third-party cybersecurity experts to strengthen its IT security defenses to avert other breaches later on.