Athens Orthopedic Clinic Pays $1.5 Million to Settle HHS Charges of Systemic Noncompliance with HIPAA Rules
From HHS, a settlement notice involving one of thedarkoverlord’s victims. Athens Orthopedic Clinic is still facing a lawsuit from patients that made it all the way up to the Georgia Supreme Court on the issue of whether they had demonstrated enough harm to survive a motion to dismiss. Note: This blogger is the journalist referenced in HHS’s notice below and this site covered the Athens Orthopedic attack and incident response extensively in 2016 and thereafter (coverage linked from here). Athens Orthopedic Clinic PA (“Athens Orthopedic”) has agreed to pay $1,500,000 to the Office for Civil Rights (OCR) at the U.S. Department of Health and Human Services (HHS) and to adopt a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules. Athens Orthopedic is located in Georgia and provides orthopedic services to approximately 138,000 patients annually. On June 26, 2016, a journalist notified Athens Orthopedic that a database of their patient records may have been posted online for sale. On June 28, 2016, a hacker contacted Athens Orthopedic and demanded money in return for a complete copy of the database it stole. Athens Orthopedic subsequently determined that the hacker used a vendor’s credentials on June 14, 2016, to access their electronic medical record system and exfiltrate patient health data. The hacker continued to access protected health information (PHI) for over a month until July 16, 2016. On July 29, 2016, Athens Orthopedic filed a breach report informing OCR that 208,557 individuals were affected by this breach, and that the PHI disclosed included patients’ names, dates of birth, social security numbers, medical procedures, test results, and health insurance information. OCR’s investigation discovered longstanding, systemic noncompliance with the HIPAA Privacy and Security Rules by Athens Orthopedic including failures to conduct a risk analysis, implement risk management and audit controls, maintain HIPAA policies and procedures, secure business associate agreements with multiple business associates, and provide HIPAA Privacy Rule training to workforce members. “Hacking is the number one source of large health care data breaches. Health care providers that fail to follow the HIPAA Security Rule make their patients’ health data a tempting target for hackers,” said OCR Director Roger Severino. In addition to the monetary settlement, Athens Orthopedic has agreed to a robust corrective action plan that includes two years of monitoring. The resolution agreement and corrective action plan may be found at https://www.hhs.gov/sites/default/files/athens-orthopedic-ra-cap.pdf – PDF*. * People using assistive technology may not be able to fully access information in this file. For assistance, contact the HHS Office for Civil Rights at (800) 368-1019, TDD toll-free: (800) 537-7697, or by emailing [email protected] Of special note, and as I previously reported in covering this incident, it seemed that thedarkoverlord accessed AOC using credentials hacked from Quest Records. In the Corrective Action Plan, HHS noted that AOC had no business associate agreement in place with Quest, among others. In a statement to DataBreaches.net, Quest had claimed that they had notified their clients after discovering they had been hacked, but they did not answer my question as to when they notified AOC and whether it was before June 14 when the stolen credentials were used or not. Later today, one of the members or associates of thedarkoverlord is scheduled to plead guilty for his role in five TDO attacks, one of which appeared to be Athens Orthopedic.
Georgia Supreme Court resuscitates patient lawsuit against Athens Orthopedic Clinic
The Georgia Supreme Court has breathed new life into a lawsuit by patients of Athens Orthopedic Clinic (AOC) whose data were stolen by thedarkoverlord in 2016. In a decision issued this week, the judges unanimously reversed the Court of Appeals’ dismissal of the lawsuit, vacated other parts of their ruling, and remanded the case. At issue before the court was how Georgia law would apply the cognizable injury required for standing in a negligence suit under state law. The lower court had granted the clinic’s motion to dismiss based on the majority agreeing that any harm alleged by the plaintiffs was future harm and speculative. The state supreme court agreed with the plaintiffs, however, finding hat they had alleged enough harm to survive a motion to dismiss. The Athens Orthopedic Clinic case was one of thedarkoverlord’s earliest known hacks and extortion attempts in June, 2016. This site’s coverage of the case and its aftermath can be found linked from here. When the clinic wouldn’t pay the extortion demand, the hackers allegedly falsely claimed to have sold some of the data that they had listed on a dark web marketplace. But eventually, the hackers also began publicly releasing actual segments of the patient database on Pastebin. The pastes were downloaded by unnamed others, increasing the risk that patient data was falling into criminals’ hands or was being acquired by those who could and would misuse it. At least one named plaintiff, Christine Collins, alleged that she suffered actual fraudulent activity on her credit card shortly following the attack. To add to the patients’ concerns, AOC announced that it did not have any insurance that would cover it for offering affected patients credit monitoring and/or identity theft restoration services. While the litigation continues to work its way through the courts, one member of thedarkoverlord is preparing to stand trial for his role in the attack on the clinic and four other attacks. Although not identified by name, AOC appears to be Victim 5 in Nathan Wyatt’s indictment. It also appears that AOC was the victim who received the “rap-style” phone threats, allegedly made by Wyatt. AOC reported the incident to HHS in the summer of 2016, but there is still no closing summary on any investigation by OCR, which may mean that they still have an open investigation or case. DataBreaches.net notes that OCR already closed its investigation into other TDO hacks during that same time period, including two of the Missouri victims involved in the Wyatt case: Prosthetic & Orthotics Care and Midwest Orthopedic Pain and Spine. The fact that the AOC case is not closed could mean that the Atlanta region of OCR is just more backlogged than Missouri, or it may be a sign that AOC is not out of the woods with OCR yet. One of the questions OCR may have for AOC may relate to claims by the hackers that even after AOC knew that they had been hacked, they still didn’t change their login credentials to all their systems, even after weeks and two emails from the hackers letting them know that they still had access. Not only might OCR have some questions as to whether that happened, but if it did happen, it might support the plaintiffs’ negligence claims.
Are thedarkoverlord’s victims entitled to damages from Athens Orthopedic Clinic? Georgia Supreme Court to rule.
Bill Rankin reports: In the spring of 2016, a cyber thief calling himself the “Dark Overlord” hacked into the databases of a Clarke County medical clinic and emerged with the personal information of an estimated 200,000 patients. The Athens Orthopedic Clinic refused to pay the hacker’s ransom and advised current and former patients to set up anti-fraud protections. Now a lawsuit filed by three of those patients — demanding that the clinic pay damages — could set a precedent in Georgia, where reports of data breaches have been soaring. Read more on AJC. The plaintiffs in the case are Christine Collins, Paulette Moreland, and Kathryn Strickland. The case number for the docket is S19G0007.
Athens Orthopedic Clinic patient data still exposed on leak site
DataBreaches.net discovered today that two copies of a paste (data dump) with over 860 AOC patients’ information is still available online if you know where to look for it. I’m providing a redacted screenshot below so patients can get a sense of what these pastes/leaks look like, although I’ve blacked out most of the street addresses, the patients’ last names, their date of birth, Social Security number, and other information that was in these records. The first leak by the hackers was removed after AOC reported it to Pastebin; that leak had 500 patients’ information in the same format as the one below. Keep in mind that there were over 860 entries like the few you’re seeing below and there was more than one copy of this paste on Pastebin. According to Pastebin, there have been 52 views of this paste as of today. Here are the data fields labels that were in this database, although not all fields had data in them: “/Today”,”/TodayLong”,”/PrimaryHealthInsCo”,”/PrimaryHealthInsType”,”/SecondaryHealthInsCo”,”/ SecondaryHealthInsType”,”/Address1″,”/Address2″,”/Age”,”/AnAge”,”/AgeSingular”,”/DOB”,”/CellPhone”,”/ City”,”/Email”,”/Fax”,”FName”,”FNameCaps”,”LName”,”/MI”,”LNameCaps”,”/NamePrefix”,”/NameSuffix”,”/ Note”,”/personid”,”/Phone”,”/PhoneExtension”,”/WorkPhone”,”/WorkPhoneExtension”,”/Race”,”/ Sex”,”man/woman”,”male/female”,”male/femaleFirstCap”,”he/she”,”he/sheFirstCap”,”him/her”,”his/her”, “his/herFirstCap”,”boy/girl”,”son/daughter”,”grandson/granddaughter”,”/SharedID”,”/SSNO”,”/State”,”/JobTitle”,”/ Zip”,”/UDF1″,”/UDF2″,”/UDF3″,”/UDF4″,”/UDF5″,”/UDF6″,”/UDF7″,”/UDF8″,”/UDF9″,”/UDF10″,”/PriDrPersonID”,”/ PriUDF1″,”/PriUDF2″,”/PriUDF3″,”/PriUDF4″,”/PriUDF5″,”/PriUDF6″,”/PriUDF7″,”/PriUDF8″,”/PriUDF9″,”/ PriUDF10″,”/PriDrAlias”,”/PriDrFirst”,”/PriDrLast”,”/PriDrNamePrefix”,”/PriDrNameSuffix”,”/PriNote”,”/ PriDrAddr1″,”/PriDrAddr2″,”/PriDrPhoneExtension”,”/PriDrEmail”,”/PriDrCellPhone”,”/PriDrFax”,”/PriDrPhone”,”/ PriDrZip”,”/PriDrState”,”/PriDrCity”,”/PriNPI”,”/RefPersonID”,”/RefDrAddr1″,”/RefDrAddr2″,”/RefDrCity”,”/ RefDrFirst”,”/RefDrLast”,”/RefDrNamePrefix”,”/RefDrNameSuffix”,”/RefNote”,”/RefDrPhone”,”/RefDrPhoneExtension”,”/ RefDrEmail”,”/RefDrCellPhone”,”/RefDrFax”,”/RefDrState”,”/RefDrZip”,”/RefUDF1″,”/RefUDF2″,”/RefUDF3″,”/ RefUDF4″,”/RefUDF5″,”/RefUDF6″,”/RefUDF7″,”/RefUDF8″,”/RefUDF9″,”/RefUDF10″,”/RefNPI”,”/PRIMINSPOLICYID”,”/ PRIMINSGROUPID”,”/SECONDARYINSPOLICYID”,”/SECONDARYINSGROUPID” DataBreaches.net has reported the two pastes to Pastebin to ask them to remove them promptly, and will check back tomorrow to see if they have been removed. Update 1 of Aug. 18: On July 25, this site reported that AOC had begun notifying patients (two) days after this site had notified it that a paste with 500 patients’ information had appeared on Pastebin with a note from the hackers. At the time, AOC gave this site a statement that said, in part: At the same time as all this was going on, we found out about the Pastebin dumps just before your email (yet remain grateful to your letting us know, as well) and have been trying since early Saturday to get the first removed and then the second one since yesterday. Last night, I discovered that in addition to the two pastes dated August 3rd that I reported yesterday as still being online, there was yet another paste – this one dated July 26 (after AOC’s statement) also still available online. This paste was identified by the hackers as a second copy of another paste. It also contains 500 patients’ details. Note that these pastes would be very hard for AOC to find as they would not show up in a routine search. But how many entities did the hackers share the links to these pastes with? Each paste was viewed at least dozens of times. DataBreaches.net has now requested that Pastebin remove this newly found paste, but that paste may put the number of unique patients’ leaked records at about 2,000 or more. I hope AOC has copies of all these pastes so that they know exactly which patients had their details leaked on Pastebin in addition to being put up for sale on TheRealDeal market. Update of Aug 22: the pastes are still online, and I have emailed Pastebin again to request removal or an explanation of why they haven’t removed these pastes.
Athens Orthopedic Clinic incident response leaves patients in the dark and out of pocket for protection
On June 26, after learning that databases with patients’ protected health information had been put up for sale on the dark web, DataBreaches.net began investigating and trying to alert the victim entities so that they could take immediate steps to try to mitigate harm to patients. By that evening, I had sent an email to Athens Orthopedic Clinic (AOC) in Georgia, to say that it appeared that they had been hacked. I followed up the next day via e-mail and a phone call to make sure they received my notification. On June 29, they issued a statement confirming that they were investigating a potential breach that they had first been made aware of in the previous 48 hours. But their incident response after that point raises questions about any risk assessment and plan for breach response that they may have had in place, and how decisions they made may have negatively impacted the very patients to whom they were and are responsible. Did AOC’s Response to Ransom Demands Lead to Retribution by Hackers? Dealing with a ransom demand, as was the case here, is never an easy situation or decision. Paying a ransom does not guarantee that the extorters will not come back at a later time and demand more money. Nor does it guarantee that the criminals will not take the ransom and then sell the patient data on the dark web anyway. There is really no clear guidance for healthcare entities as to how to respond to this type of situation, as HHS’s recent guidance on how to respond to a ransomware demand doesn’t really apply when you know that the attacker actually has all of your patients’ information and is threatening to misuse it, leak it, or sell it. But ticking off the criminals by telling them that you’ll pay and then not paying, or stringing them along – even if it is at someone’s suggestion – may have backfired for AOC’s patients. Had AOC simply refused to pay the ransom from the outset or had they paid it, TheDarkOverlord (TDO) hackers likely would not have as responded as punitively as they did. According to emails DataBreaches.net has read, at various points, AOC indicated that it was willing to pay some ransom but needed to work out a payment system. Later, they indicated they were willing to do a wire transfer. At other points, they didn’t respond by deadlines TDO had given them, infuriating the hackers. Read in sequence, the emails might appear to be stringing TDO along, stalling them, or jerking them around. And according to statements made to DataBreaches.net by TDO in encrypted chats, some of the public leaks of AOC’s patient information were in direct response to AOC failing to follow through on what it had told the hackers it would do. The TL;DR version is that TDO informed this site that they were determined to make an example of AOC to show the world that you don’t screw around with TDO. And they even warned AOC. As just one example, a snippet from one of their emails to AOC: If you continue to play these fucking games with us, a sort of hostage kill off is going to occur and leave thousands of patients records publicly listed and abused with your name signed to all of it as the source. So would patient data have been publicly leaked or would as much data have been leaked if AOC had made a decision, informed the attackers of that decision, and stuck to it? AOC’s ever-changing responses and missed deadlines appears to have resulted in more patients having their details leaked on Pastebin. Are Patients’ Data Still At Risk? Although AOC may have become a victim due to a vendor’s failure to secure their credentials, and while AOC trauma surgeon Chip Ogburn wrote a passionate and obviously heartfelt letter to patients assuring them that AOC is committed to rectifying the data breach, there are also other questions raised by AOC’s incident response. That AOC didn’t know that they had been hacked and only learned of the hack weeks later when they were alerted to it by this site is not surprising to anyone familiar with breaches. But it still begs the question as to what software or technical safeguards AOC had in place to detect intrusions and the exfiltration of hundreds of thousands of patients’ records that included image files. Both HHS and the FTC may have questions about that. See also: Quest Records LLC Breach linked to TheDarkOverlord hacks; more entities investigate if they’ve been hacked And once AOC confirmed that there had been an intrusion and patient data had been acquired, why didn’t they immediately change all passwords – even after the hackers contacted them and lectured them on their failure to change passwords? AOC’s statement on their web site says, in part (emphasis added by me): If you were a patient of any Athens Orthopedic Clinic location or the patient of a doctor or provider who worked with any of our locations on or before June 14, 2016, we regret to tell you that that our electronic medical records system has been compromised and that your personal information is vulnerable. but DataBreaches.net has seen correspondence indicating that information of patients seen after June 14 was still accessible to the hackers. These emails indicate that TDO informed AOC in mid-July that they still had access to AOC’s internal network. They even mentioned specific systems that were still vulnerable. Here are some snippets from TDO emails to AOC during June and July: …. We are still in your system right now in fact. You have done little to mitigate against an advanced attacker. Pulling the internet plug won’t help when you have embedded devices that run over a cellular network. …. Now up to this point, you should have already changed all the passwords and usernames for all your systems, but they were not changed for all your systems. They should have been amended immediately from the time we sent the first email. We understand it may take a day or two…. However, within a few hours of the second email they should have definitely been changed seeing as how we specifically listed some systems by name. For record, they were not changed even at this time. It is now over two weeks later, and the passwords are […]
Extortion demand on Athens Orthopedic Clinic escalates as patient data is dumped
On June 26, DataBreaches.net reported that several databases with patient information had allegedly been hacked and put up for sale on the dark net by hackers calling themselves TheDarkOverlord (TDO). This site subsequently identified one of the entities as the Athens Orthopedic Clinic in Georgia, and contacted them to alert them that it appeared that they had been hacked. On July 25, AOC publicly acknowledged that they had been hacked and patient data stolen. Their notification came just days after 500 patients’ information was leaked on Pastebin with a note to the CEO to “pay the f**k up.” The warning was in reference to a ransom demand of 500 BTC that had been made by TDO on June 27th. At the time, that sum converted to about $335,000. By the hackers’ calculations, AOC could protect the patient data from disclosure for about $1 per patient, which is considerably less than it would cost AOC to offer its patients credit monitoring services. Despite the bargain rate, the warning issued on Pastebin suggests that AOC was not complying with the ransom demand. As I noted in my previous reporting, when AOC did confirm and disclose the breach, they did not publicly acknowledge that they had received any ransom demand. Nor did they disclose that patient data had already been leaked on Pastebin. Today, more of AOC’s patient data was leaked on Pastebin. As is my policy, DataBreaches.net is not linking to the pastes. There may be more pastes than this site currently knows about, but at least 1,500 more AOC patients apparently had their information leaked today. In an encrypted chat with a spokesperson for TDO who declined to provide his individual nick or role in the hack and extortion demands, DataBreaches.net was told that TDO has already been selling the data on the dark net. The sales, they claim, would not show up on TheRealDeal Market (TRD), which they say they mainly use as a listing service. According to the spokesperson, TDO sells data, gives the buyer a chance (time) to misuse it, and then leaks the data publicly so others can also misuse it. If the spokesperson is being truthful (DataBreaches.net has no way to confirm or disconfirm these claims), then every AOC patient whose data has been leaked on Pastebin had their information previously sold to criminals. The spokesperson also stressed that if the patient’s information has not appeared on Pastebin, it has not (yet) been sold. So far, the TDO spokesperson claims, they have sold anywhere between 5,000 – 6,000 patients’ information. DataBreaches.net asked AOC to respond to the hackers’ claims and reiterated a request for an explanation as to why they have not publicly acknowledged any ransom demand, and why they have seemingly not informed patients that their information has been leaked. In response, a spokesperson for AOC sent the following statement: I’m unable to confirm any of what you write about what the hacker has recently told you. AOC continues to work with its team to take all available steps to mitigate the criminal actions of the hacker, to secure its system, and to inform its patients of what has happened. AOC reported the breach to both law enforcement authorities and to HHS and is in the process of fulfilling its notification requirements under HIPAA. As you know, we felt it best to get ahead of the official notification with early notice on AOC’s website, and toll-free line, as well as by providing you a quote early on and releasing information to a few select local media. In terms of your previous question re ransom demands, we have said to those who ask that there have been attempts at extortion for ransom. As you have reported, paying ransom does not guarantee any further criminal activity will not take place. We’ve asked Pastebin to take down all the dumps, as anyone can when they see illegal activity, as soon as we find out about them, and that has taken more than 24-48 hours for several. So if patients know to ask about ransom or whether their data have been publicly leaked, they may find out, but otherwise…? DataBreaches.net continues to believe that HHS should address this issue as an interpretation of HITECH: should patients be informed of such developments so that they have adequate information to assess their risk? In the meantime, TDO claims that they have been selling patient records for an average of $17.82 a record, with a low of $5.72/record to a high of $25 per record. Today, because AOC missed the ransom deadline, TDO raised the ransom demand to 700 BTC. In a statement to DataBreaches.net, they say: We are doing our best to ensure that our demands are either met or that further harm comes to AOC and their current and former patients. We hope that the current and former patients understand that Kayo Elliot has the power to cease all of this abuse and drama by satisfying our demands. We have been more than amicable from the beginning and have escalated as a result of non-compliance. If the past is any predictor of the future, DataBreaches.net expects to see many more pastes of AOC patient data, and possibly all of the database, which, according to TDO’s listing on TRD, has records on almost 397,000 patients. AOC patients should not only consider putting a security freeze on their credit reports, but should also be diligent about checking any explanation of benefits (EOB) statements they get from their health insurer, to see if there is any evidence that their insurance account information has been used for insurance fraud.
Athens Orthopedic Clinic to begin notifying patients of hack (UPDATE2)
On June 26, this site reported that a database with almost 397,000 patient records was up for sale on the dark net. I subsequently tentatively identified the entity as Athens Orthopedic Clinic in Georgia, but they never officially confirmed that it was their data, noting only that they were investigating and had only first found out about the breach – a claim that the TheDarkOverlord disputed. They also acknowledged to this site that they had received an extortion demand. TDO eventually identified AOC as the entity, but AOC has remained publicly silent – until now. Over the weekend, 500 patients ‘records from Athens Orthopedic Clinic appeared on Pastebin, with a note to their CEO to “pay the fuck up.” DataBreaches.net contacted AOC to alert them to the paste and to ask for an update on their investigation and response. The following statement, received this evening, can be attributed to a spokesperson from their PR firm: We’ve been working hard to determine which patients were affected by the breach and how. That information was confirmed late last week. Since then we’ve been working hard to be sure we have correct addresses and to get a HIPAA patient notice properly prepared. That process continues with printing and mailing starting tomorrow. I understand HHS/OCR posting needs to happen after breach notification is in the patients’ hands. At the same time as all this was going on, we found out about the Pastebin dumps just before your email (yet remain grateful to your letting us know, as well) and have been trying since early Saturday to get the first removed and then the second one since yesterday. AOC is working with authorities. As of just a few minutes ago, we have a toll-free number live at 844-382-9364 for patients who may hear about the breach before they get our letter, as well as a statement on the AOC website. The text of their statement on their web site makes no mention of any extortion demand or their response to it, and does not directly name SRS, whose software the hackers had identified as vulnerable (see Update2, below) Athens Orthopedic Clinic recently experienced a data breach due to an external cyber-attack on our electronic medical records using the credentials of a third-party vendor. Personal information of our current and former patients has been breached, including names, addresses, social security numbers, dates of birth and telephone numbers, and in some cases diagnoses and partial medical history. We apologize for the stress and worry this situation may cause our patients and their families. We are committed to keeping patient information safe and assure you we are doing everything possible to retain your trust in our practice. If you are a current or past patient, we advise you to take the following steps: 1. Call the toll-free number of any of the three major credit bureaus (below) to place a fraud alert on your credit report. Equifax: (888)766-0008; www.fraudalerts.equifax.com. General: (800) 685-1111, www.equifax.com, P.O. Box 740241, Atlanta, GA 30374-0241. Experian: (888) 397-3742; https://www.experian.com/fraud/center.html. General: (888)EXPERIAN (397-3742); www.experian.com; 475 Anton Blvd., Costa Mesa, CA 92626. TransUnion: (800) 680-7289 (888-909-8872 for freeze); http://www.transunion.com/personal-credit/credit-disputes/fraud-alerts.page; TransUnion Fraud Victim Assistance Department, P.O. Box 2000, Chester, PA 19022-2000. General: (800) 680-7289; www.transunion.com 2. Order your credit reports. By establishing a fraud alert, you will receive a follow-up letter that will explain how you can receive a free copy of your credit report. When you receive your credit report, examine it closely and look for signs of fraud, such as credit accounts that are not yours, then continue to monitor your credit reports to ensure an imposter has not opened an account with your personal information. To protect against such breaches in the future, Athens Orthopedic Clinic has retained cyber security experts to investigate and make recommendations for additional improvements to our system, and have begun implementing these recommendations. You may contact our toll-free telephone number at 844-382-9364 for additional information. As always, our focus remains on patient care and we appreciate your understanding and patience. UPDATE1: It looks like TheDarkOverlord decided to contact local media and revealed more about their extortion demands. UPDATE2: Although TDO had informed this journalist that SRS software was vulnerable, that should not be construed as indicating that they were the third-party vendor being referred to in AOC’s statement – or in the statement by the Farmington entity, also released today. Note that in emails to AOC released on WGAUradio, the hackers make reference to AOC never changing passwords even after they were notified by the hackers of exactly what some of the compromised systems were. That claim bears further investigation and a statement from AOC as to why they did not change passwords. Were they advised not to, for some reason?
Three more medical practices hit by ransomware
Atlanta does not seem to be a safe place for cybersecurity of orthopedic patients’ data. In 2016, orthopedic clinics in Atlanta got clobbered by two big breaches involving thedarkoverlord. The first was a hack and extortion demand on Athens Orthopedic Clinic, an organization that had more than a dozen locations but somehow didn’t have enough insurance to offer their patients any complimentary credit monitoring services. We also learned about a second hack and extortion attempt by thedarkoverlord against Peachtree Orthopedic, who after initially (and falsely) claiming that I had my facts all wrong, finally disclosed their breach, only to have more than 500,000 patients’ data dumped by thedarkoverlord shortly thereafter. Now another chain of Atlanta orthopedic centers has been hit by threat actors. This time, it is Piedmont Orthopedics / OrthoAtlanta that has been hit, and by Pysa (Mespinoza) threat actors. The threat actors have already dumped more than 3.5 GB of data. Much of it is information about rentals and business aspects, but looking through the files, I found a number of highly detailed medical records on patients that include their name, date of birth, address and contact information, diagnosis, surgical details, laboratory tests, cardiograms, and insurance information — pages and pages of protected health information. The files may have been exfiltrated on July 11, looking at the time-stamps in the dumped archive. There is no notice on the medical group’s website and nothing on HHS’s public breach tool at this time. DataBreaches.net sought a statement and additional details from the medical group but did not get a reply by publication time. This post will be updated if a reply is received. But Piedmont Orthodpedics/OrthoAtlanta is not the only medical group to have been hit recently by ransomware. The Center for Fertility and Gynecology in California and Olympia House Rehab, also in California, have both been recently hit by Netwalker ransomware. Neither one of those latter entities has any notice on their web sites, and the attackers have not yet dumped any of their data, although they have posted some screenshots as proof of access and are threatening to dump data soon if their victims don’t pay up. DataBreaches.net also reached out to the Netwalker victims for additional details and any statement, but also received no reply from them by publication time.
One down: Nathan Wyatt of thedarkoverlord agrees to plead guilty
A U.K. man extradited to the U.S. in December to stand trial for his role in thedarkoverlord (TDO) has agreed to plea guilty to resolve all charges against him. Nathan Francis Wyatt, also known as “Crafty Cockney,” has agreed to plead guilty to charges stemming from his role in some of thedarkoverlord’s attacks on entities in Missouri and Georgia in 2016. The attacks on medical entities shocked the public because the attackers named and shamed their victims and started dumping patient data if the victims did not pay their extortion demands, which were often in the range of hundreds of thousands of dollars. TDO’s tactics also included calling the victim entities or their family members on the phone or sending them aggressive or crude messages. From the description in court filings, the federal charges against Wyatt stemmed from his alleged roles in attacks against Athens Orthopedic Clinic in Atlanta, Midwest Pain & Spine in Missouri, Prosthetic & Orthotic Care in Missouri, Quest Health Information Management Solutions, and one entity not related to healthcare. None of the victims were named in court filings and the preceding attributions are based on this site’s knowledge of TDO’s attacks and the court’s description of the victims. On May 20, Wyatt’s trial, which had been scheduled to begin June 15, had been delayed to September 21 due to the pandemic. The court noted that holding the trial in June would endanger the public and make it difficult to assemble a fair cross-section of citizens to serve on the jury. Yesterday, however, both his counsel and the government filed a joint motion with the court requesting a consolidated plea and sentencing hearing. Wyatt is represented by a federal public defender, Brocca Morrison. The government is represented by Senior Counsel Laura Kate-Bernstein, Jeffrey B. Jensen, United States Attorney for the Eastern District of Missouri, and Gwendolyn E. Carroll of the Eastern District of Missouri. As detailed in previous coverage on this site, Wyatt had been charged with: One count of conspiracy against the U.S. (18 USC 371 ) Two counts of aggravated identity theft (18 USC 1028); and Three counts of threatening damage to a protected computer (18 USC 1030) He was not charged with actual hacking. The agreed-upon but not yet disclosed guilty plea comes as no surprise because the amount of evidence the prosecution had amassed was somewhat staggering. That said, this site and blogger have disputed any claim that Wyatt was ever the leader of thedarkoverlord in 2016 or 2017, but it was clear from my interviews and chats with him that he had been involved in assisting or conspiring with one other person in a number of ways. The plea and sentencing hearing will not take place for at least 90 days. Wyatt is the first person to have been publicly identified as arrested and charged for participation in TDO crimes. He had claimed in the past to know the real identity of the young person that he referred to as “Dark” but that claim may have been part of a scam that he was trying to run. Wyatt reportedly later told someone else that he didn’t know the other’s real identity.
Missouri law firm sued by insurer for not disclosing 2016 hack by thedarkoverlord
For the past few years, this site has covered litigation against Athens Orthopedic Clinic in Georgia related to their hack by thedarkoverlord in 2016. The lawsuit against the clinic, filed by a patient, made it all the way to the Georgia Supreme Court on the issue of whether under Georgia state law, the plaintiff had shown enough harm to survive a motion to dismiss. The state’s highest court agreed with the plaintiff on appeal, and the case has been remanded. And while that case may be costly for the clinic, that hack may also be costly for an alleged member of thedarkoverlord (TDO) who was extradited to the U.S. to stand trial for his alleged role in hacks in Missouri and Atlanta — including, it appears, the Athens Orthopedic Clinic hack (although the court filings do not name the victim entities). According to the federal complaint against him, Nathan Wyatt, aka “Crafty Cockney” and “Mas Mas,” allegedly set up accounts that were used as part of TDO’s hacking and extortion operations, and he allegedly called a victim and threatened him in rap as to what would happen if the victim didn’t pay up. But the Athens Orthopedic Clinic hack may not be the only TDO hack Wyatt was allegedly involved in that has resulted in litigation. Regular readers may recall that in 2018, TDO started leaking what they claimed were hacked files related to 9/11. Those files came from a law firm used by insurer Hiscox. Hiscox informed this site that they had learned of the breach in April 2018, but Hiscox’s statement to this site did not reveal that the unnamed law firm was hacked in December 2016. This week, Hiscox filed suit against the Missouri-based law firm, Worden Grier, LLP. The suit was first reported by Law360.com. In the complaint, the insurer alleges that: 11. On or around December 2016, an international hacker organization known as “The Dark Overlord” (“Hackers”) gained unauthorized access to Warden Grier’s computer system containing all of the sensitive information, including PI, stored on Warden Grier’s servers (the “2016 Data Breach”). 12. On information and belief, Hiscox understands that Warden Grier contacted outside attorneys and the FBI to investigate the matter, but did not hire a forensic IT firm to investigate the 2016 Data Breach or, if it did, has refused to provide Hiscox with the findings of any such investigation. 13. Despite being aware of the 2016 Data Breach, Warden Grier actively concealed or otherwise did not notify Hiscox or Hiscox’s insureds—all of whom were Warden Grier’s clients—of the 2016 Data Breach. Hiscox claims that they became aware of the breach on March 28, 2018, when some of the data appeared on the dark web. When they investigated by contacting Warden Grier, they learned that Warden Grier had not only failed to inform them, but they had not informed any of Hiscox’s clients. According to the complaint, Warden Grier paid TDO ransom or other demand to protect its and its clients’ personal information from dissemination. [DataBreaches.net notes that this would not be the first time that TDO was paid ransom and then disclosed data anyway. TDO occasionally claimed that a victim had violated some provision of their agreement, thereby justifying their actions in either dumping data or demanding further payment.] In any event, the Hiscox lawsuit is interesting because in December 2016, law enforcement in the U.K. charged Nathan Wyatt with a number of crimes, including hacking an unnamed law firm and trying to extort it. Wyatt pleaded guilty to all charges and was jailed. So was that law firm Warden Grier? If so, then Wyatt may have already served time for that hack in a U.K. jail. Or was this yet another law firm? DataBreaches.net has been unable to reach Warden Grier yet, but has sent an inquiry to Hiscox’s law firm in the suit and will update this post if more information becomes available.