On June 26, after learning that databases with patients’ protected health information had been put up for sale on the dark web, DataBreaches.net began investigating and trying to alert the victim entities so that they could take immediate steps to try to mitigate harm to patients. By that evening, I had sent an email to Athens Orthopedic Clinic (AOC) in Georgia, to say that it appeared that they had been hacked. I followed up the next day via e-mail and a phone call to make sure they received my notification. On June 29, they issued a statement confirming that they were investigating a potential breach that they had first been made aware of in the previous 48 hours. But their incident response after that point raises questions about any risk assessment and plan for breach response that they may have had in place, and how decisions they made may have negatively impacted the very patients to whom they were and are responsible. Did AOC’s Response to Ransom Demands Lead to Retribution by Hackers? Dealing with a ransom demand, as was the case here, is never an easy situation or decision. Paying a ransom does not guarantee that the extorters will not come back at a later time and demand more money. Nor does it guarantee that the criminals will not take the ransom and then sell the patient data on the dark web anyway. There is really no clear guidance for healthcare entities as to how to respond to this type of situation, as HHS’s recent guidance on how to respond to a ransomware demand doesn’t really apply when you know that the attacker actually has all of your patients’ information and is threatening to misuse it, leak it, or sell it. But ticking off the criminals by telling them that you’ll pay and then not paying, or stringing them along – even if it is at someone’s suggestion – may have backfired for AOC’s patients. Had AOC simply refused to pay the ransom from the outset or had they paid it, TheDarkOverlord (TDO) hackers likely would not have as responded as punitively as they did. According to emails DataBreaches.net has read, at various points, AOC indicated that it was willing to pay some ransom but needed to work out a payment system. Later, they indicated they were willing to do a wire transfer. At other points, they didn’t respond by deadlines TDO had given them, infuriating the hackers.  Read in sequence, the emails might appear to be stringing TDO along, stalling them, or jerking them around. And according to statements made to DataBreaches.net by TDO in encrypted chats, some of the public leaks of AOC’s patient information were in direct response to AOC failing to follow through on what it had told the hackers it would do. The TL;DR version is that TDO informed this site that they were determined to make an example of AOC to show the world that you don’t screw around with TDO. And they even warned AOC. As just one example, a snippet from one of their emails to AOC: If you continue to play these fucking games with us, a sort of hostage kill off is going to occur and leave thousands of patients records publicly listed and abused with your name signed to all of it as the source. So would patient data have been publicly leaked or would as much data have been leaked if AOC had made a decision, informed the attackers of that decision, and stuck to it?  AOC’s ever-changing responses and missed deadlines appears to have resulted in more patients  having their details leaked on Pastebin. Are Patients’ Data Still At Risk? Although AOC may have become a victim due to a vendor’s failure to secure their credentials, and while AOC trauma surgeon Chip Ogburn wrote a passionate and obviously heartfelt letter to patients assuring them that AOC is  committed to rectifying the data breach, there are also other questions raised by AOC’s incident response. That AOC didn’t know that they had been hacked and only learned of the hack weeks later when they were alerted to it by this site is not surprising to anyone familiar with breaches. But it still begs the question as to what software or technical safeguards AOC had in place to detect intrusions and the exfiltration of hundreds of thousands of patients’ records that included image files. Both HHS and the FTC may have questions about that. See also: Quest Records LLC Breach linked to TheDarkOverlord hacks; more entities investigate if they’ve been hacked   And once AOC confirmed that there had been an intrusion and patient data had been acquired, why didn’t they immediately change all passwords – even after the hackers contacted them and lectured them on their failure to change passwords?  AOC’s statement on their web site says, in part (emphasis added by me): If you were a patient of any Athens Orthopedic Clinic location or the patient of a doctor or provider who worked with any of our locations on or before June 14, 2016, we regret to tell you that that our electronic medical records system has been compromised and that your personal information is vulnerable. but DataBreaches.net has seen correspondence indicating that information of patients seen after June 14 was still accessible to the hackers. These emails indicate that TDO informed AOC in mid-July that they still had access to AOC’s internal network. They even mentioned specific systems that were still vulnerable. Here are some snippets from TDO emails to AOC during June and July: …. We are still in your system right now in fact. You have done little to mitigate against an advanced attacker. Pulling the internet plug won’t help when you have embedded devices that run over a cellular network. …. Now up to this point, you should have already changed all the passwords and usernames for all your systems, but they were not changed for all your systems. They should have been amended immediately from the time we sent the first email. We understand it may take a day or two…. However, within a few hours of the second email they should have definitely been changed seeing as how we specifically listed some systems by name. For record, they were not changed even at this time. It is now over two weeks later, and the passwords are […]