Healthcare company Norton says a May breach led to the theft of data of around 2.5 million of its patients, as well as employees and their dependents.<\/p>\n
Norton has more than 40 clinics and hospitals in and around Louisville, Kentucky. In\u00a0a filing with Maine\u2019s attorney general on Friday,<\/a>\u00a0Norton said that on May 9, 2023, it discovered an \u201cexternal system breach.\u201d While the attackers were in the system, Norton says, the sensitive data of the patients, and employees and their dependents was accessed.<\/p>\n In a security incident notice<\/a> as well as the letter that was sent to potential victims, Norton said the attackers accessed certain network storage devices, but did not access Norton Healthcare\u2019s medical record system or Norton MyChart, its electronic medical record system.<\/p>\n The leaked information included names, dates of birth, Social Security numbers, health and insurance information, and medical identification numbers. Some people also had their\u00a0financial account numbers, driver licenses or other government ID numbers, and digital signatures also taken.<\/p>\n While Norton never called the incident a ransomware attack, according to databreaches.net<\/a> the attack was claimed by ALPHV\/BlackCat. We could not confirm this, since at the time of writing, the ALPHV leak site is recovering from an outage due to problems with their hosting provider<\/a>.<\/p>\n Norton says it told law enforcement about the attack and confirmed it did not pay any ransom payment. ALPHV claims to have extracted 4.7 TB worth of data and posted dozens of files as proof to get negotiations underway.<\/p>\n ALPHV is one of the most active ransomware-as-a-service (RaaS) operators and regularly appears in our\u00a0monthly ransomware reviews<\/a>\u00a0as one of the top five most active groups. Recently they made headlines when one of their affiliates, known as\u00a0Scattered Spider<\/a>\u00a0attacked MGM<\/a>. They also filed a SEC complaint about one of their victims<\/a>\u00a0for failing to disclose a breach.<\/p>\n Our podcast host David Ruiz talked to ransomware expert Allan Liska about the why of the SEC complaint.<\/p>\n