Intellihartx, a Tennessee company that provides patient balance resolution and collections services to hospitals, notified about 490,000 people in mid-2023 that their personal and health information had been stolen. Filings with the Maine Attorney General's Office put the figure at 489,830.
The data was taken through Fortra's GoAnywhere managed file transfer software. The Clop group exploited a zero-day vulnerability in the product, tracked as CVE-2023-0669, in late January 2023, running a campaign of theft and extortion rather than file encryption. Intellihartx learned of the incident on February 2, 2023.
The review of affected files ran into the spring. Preliminary results on March 24 indicated sensitive data had potentially been stolen, Intellihartx began notifying the affected data owners on April 11, confirmed on May 10 that protected health information had been taken, and completed the review on May 19. The exposed records included names, addresses, dates of birth, Social Security numbers, diagnoses, medications, insurance details and medical billing information.
Intellihartx said it was not aware of the information being misused. The Clop group had already published data it attributed to the company on its leak site, which sits uneasily with that statement. The company rebuilt its file transfer platform with additional security controls and offered complimentary credit monitoring to those notified.