Tampa General Hospital disclosed on July 19, 2023 that an unauthorized party had reached its network and copied files containing the personal information of approximately 1.2 million patients.
The Florida hospital said its forensic investigation placed the intrusion between May 12 and May 30, 2023, with unusual activity detected on May 31. Investigators concluded the attackers had spent roughly three weeks inside the network before being found.
The data taken varied by individual and included names, addresses, phone numbers, dates of birth, Social Security numbers, health insurance details, medical record and patient account numbers, dates of service and limited treatment information. The hospital said its electronic medical record system was not accessed.
Tampa General said internal monitoring stopped the attackers from encrypting files, so clinical operations continued without interruption. It notified the FBI, mailed letters to affected individuals and offered complimentary credit monitoring and identity theft protection to those whose Social Security numbers were involved. The Snatch ransomware group claimed the theft on its leak site on July 18, 2023, a day before the hospital's public notice.
Tampa General initially reported the breach to the U.S. Department of Health and Human Services Office for Civil Rights as affecting up to 1,313,636 individuals, then amended the report to up to 2,430,920 individuals. Litigation over the breach began in August 2023, with plaintiffs criticizing the roughly 50 day gap between detection and notification.
Sources
- Tampa General Hospital Data Breach Impacts 1.2 Million PatientsInfosecurity Magazine
- Tampa General Hospital half thwarts ransomware attack, but still loses patient dataMalwarebytes / ThreatDown
- Tampa General Hospital Sued Over 1.2 Million Record Data BreachHIPAA Journal
- Tampa General reports confidential data of 1.2 million patients hackedTampa Bay Times
- Tampa General Hospital Data Breach SettlementHIPAA Journal