SERV Behavioral Health System in New Jersey provides Social, Educational, Residential, and Vocational services to children and adults with adults and children trying to cope with serious mental illness or a developmental disability.
On May 26, their files were allegedly encrypted by Hive ransomware team. On July 14, Hive added SERV BHS to their leak site, presumably because BHS wasn’t paying their ransom demand.
BHS did not respond to an email inquiry DataBreaches sent on July 14.
Nor have they responded to an email inquiry DataBreaches sent on August 3, asking them again for comment about the claimed breach and reminding them that it was now more than 60 days since they would have discovered that they had allegedly been attacked.
Does SERV Behavioral Health System deny that they have been breached? Will they confirm it? Have they notified any state or federal regulators? Have they notified any clients?
Hive did not provide any “proof pack” that would enable DataBreaches to determine if their claim is likely true. Nor has Hive indicated how much data they claim to have exfiltrated, but if their claims are accurate and sensitive information was acquired by them, then shouldn’t those affected find out from SERV BHS before they find out from Hive contacting them or by reading this site?
DataBreaches does not know if SERV BHS is covered by HIPAA, but two job listings reviewed by DataBreaches required employees to successfully complete HIPAA training prior to working directly with the consumers. There is no report by them on HHS’s public breach tool at the time of this publication.
Update: DataBreaches received an interesting tip from a security professional who read this post and started doing a bit of their own research. A search of BinaryEdge revealed that exchange.servbhs.org was online with OWA in May of this year and now all of their auto discover has been moved to O365. “This possibly indicates that they had an unpatched and vulnerable OWA server online, got hit and then cleaned up their migration to the cloud and removed their legacy exchange server,” the individual wrote.
It’s an interesting possibility, but of course, it’s just a guess, at best, as SERV BHS has not been responsive at all to questions.