Yale New Haven Health System (YNHHS), which operates several hospitals in Connecticut, recently disclosed a data breach impacting the personal information of millions of patients.
The Yale University-affiliated healthcare organization revealed on April 11 that it detected unusual activity on its IT systems on March 8.
While patient care was not impacted by the incident, an investigation showed that hackers managed to copy data from Yale New Haven Health systems on the day the intrusion was discovered.
Compromised information varies by patient, but can include name, date of birth, address, phone number, email, race/ethnicity, SSN, and medical record number.
YNHHS noted that its “electronic medical record system was not involved nor accessed in this incident, and no financial accounts, payment information or employee HR information was included”.
The healthcare data breach tracker of the Department of Health and Human Services showed on Wednesday that the incident impacts more than 5.5 million individuals.
YNHHS may have been targeted in a ransomware attack, but no known cybercrime group has taken credit for it. If it was indeed a ransomware attack, the healthcare organization may have decided to pay a ransom to avoid a data leak.
SecurityWeek has reached out to YNHHS for comment and will update this article if it responds.
Many healthcare organizations disclosed significant data breaches in recent years. According to HHS data, more than 700 healthcare data breaches were reported last year in the United States, with the total number of compromised records exceeding 180 million.
Related: Data Breach at Onsite Mammography Impacts 350,000
Related: Two Healthcare Orgs Hit by Ransomware Confirm Data Breaches Impacting Over 100,000
Related: Kelly Benefits Data Breach Impacts 260,000 People