The Surge in Healthcare Data Breaches: August 2023 in Review

Breached Company

20 Sep 2023 — 2 min read

Introduction

The healthcare sector has always been a prime target for cybercriminals due to the sensitive nature of the data it holds. August 2023 witnessed a concerning surge in healthcare data breaches, exposing the protected health information of millions. This article delves into the details of these breaches, their causes, and the implications for the healthcare industry.

The Alarming Rise in Data Breaches

August 2023 saw a 21.4% month-over-month increase in healthcare data breaches, making it the second most severe month for breaches in the year. A staggering 68 breaches, each involving 500 or more records, were reported to the HHS' Office for Civil Rights. This number significantly surpassed the 2023 monthly average of 58.2 breaches. Cumulatively, over 71 million individuals' records have been compromised in 2023 alone, marking a notable escalation from the preceding year.

The Major Culprits

A significant contributor to the August breaches was the mass exploitation of a zero-day vulnerability in Progress Software's MOVEit Transfer file transfer solution. The notorious Clop group took advantage of this vulnerability, exfiltrating data and demanding hefty ransoms. This single vulnerability affected over 1,200 organizations, compromising the data of an estimated 54.2 to 59 million individuals. The Clop group's illicit activities from this breach alone are believed to have netted them between $75 million and $100 million.

Furthermore, ransomware attacks continued to plague the healthcare sector. The Royal ransomware group was identified as a significant perpetrator, specifically targeting healthcare entities. Among the most substantial breaches in August were those involving the Colorado Department of Health Care Policy & Financing, Performance Health Technology, and PurFoods, LLC.

Nature and Impact of the Breaches

Hacking and IT incidents dominated the breach landscape, accounting for 83.8% of all breaches and a whopping 99.2% of all compromised records in August. Business associates reported the largest average breach size, with an average of 250,875 records. They were closely followed by health plans and healthcare providers, with 89,344 and 83,425 records respectively.

Geographically, Texas and Illinois emerged as the states most affected by these breaches.

Enforcement Actions

In light of these breaches, the HHS' Office for Civil Rights took action. August saw a HIPAA enforcement action involving UnitedHealthcare, resulting in an $80,000 penalty for a HIPAA Right of Access violation.

Conclusion

The surge in healthcare data breaches in August 2023 underscores the pressing need for robust cybersecurity measures in the healthcare sector. With cybercriminals becoming increasingly sophisticated and relentless, healthcare entities must prioritize cybersecurity to safeguard patient data.

The exploitation of vulnerabilities, combined with targeted ransomware attacks, poses a significant threat to the integrity and security of healthcare data. Organizations must remain vigilant, continuously update their security protocols, and invest in cybersecurity training for their staff.

As the healthcare sector continues to evolve and embrace digital transformation, the onus is on industry leaders, regulators, and stakeholders to ensure that patient data remains secure and protected from malicious actors.

Unpacking the Perils: Why Lithuania's 2025 Security Threats Demand Your Attention

At Breached., we're dedicated to bringing you critical insights into the evolving landscape of global security. In a world rife with uncertainty, understanding the specific threats nations face is paramount. That's why we've delved deep into Lithuania's "National Threat Assessment 2025&

Edge Wars: Unpacking the Escalating Exploitation of Network Perimeters in 2024

The year 2024 witnessed a significant shift in the cyber security battleground, with edge devices – the often-overlooked sentinels of our networks like routers, firewalls, and VPN appliances – emerging as prime targets for both sophisticated nation-state actors and increasingly resourceful cybercriminal groups. This evolution, highlighted in the "2025 Cyber Security

Enhancing Cyber Resilience: An In-Depth Look at Incident Response Maturity Assessments

In today's evolving threat landscape, organizations face persistent and increasingly sophisticated cyber security attacks. The ability to effectively deal with these incidents is paramount, even for the most advanced organizations. Therefore, developing an appropriate cyber security incident response capability, characterized by a systematic and structured approach, is no

Measuring What Matters: Why Incident Response Maturity Is Your Organization's Hidden Security Metric

In today's rapidly evolving threat landscape, the question isn't if your organization will experience a security incident, but when. Security breaches have become an inevitable aspect of business operations, with the average cost of a data breach reaching $4.45 million in 2023, according to IBM&