Bricker & Eckler, one of the leading law firms in Ohio, suffered a ransomware attack in January in which client information was potentially compromised. The ransomware infection was detected by the law firm on January 31, 2021 and a third-party cybersecurity firm was engaged to assist with the investigation.
The investigation revealed the attackers first gained access to its systems on January 14, 2021, and access remained possible until January 31, 2021. During that time the attackers gained access to files containing client information and exfiltrated some data from the law firm’s systems.
A notice about the security incident on the law firm’s website confirms that the attackers were contacted, and information stolen in the attack was retrieved, suggesting the ransom was paid. Bricker & Eckler said the attackers confirmed they took steps to delete the stolen data and reassurances were provided that there had been no further disclosures of the stolen information and that no copies of the data had been retained.
As a full-service law firm serving clients in the healthcare industry, it was necessary for clients to provide the law firm with certain protected health information as part of the client engagement. That information was used as part of the legal services provided. It is possible that some of that information may have been viewed or obtained in the attack.
Bricker & Eckler said the protected health information potentially compromised included names and addresses and, for certain individuals, medical information and/or education-related information, driver’s license numbers and/or Social Security numbers.
The law firm started sending notification letters to all affected individuals on April 6, 2021. The law firm has taken steps to enhance the security of its network, internal systems, and applications to prevent similar attacks in the future.
The breach has been reported to the HHS’ Office for Civil Rights as affecting up to 420,532 individuals.
The post PHI of More Than 420,000 Individuals Potentially Compromised in Ransomware Attack on Ohio Law Firm appeared first on HIPAA Journal.