New Mexico Hospital Says Ransomware Removal Successful, But Unsure of Repercussions

A New Mexico hospital reports its IT staff was able to conduct a ransomware removal in November, but is unsure if patient data was compromised as a result of the data breach.

Roosevelt General Hospital in Portales, N.M. said malware was found on a digital imaging server used by the radiology department, according to HealthDataManagement.com. Even though the server was not connected to a billing system at the hospital, the server allegedly contained the identifying patient information that could benefit the hackers, including:

• Names
• Addresses
• Date of birth
• Driver’s license numbers
• Social Security numbers
• Insurance information
• Medical information
• Phone numbers
• Gender

As a result of the data breach, the hospital’s marketing and public relations director Jeanette Orrantia said patients should pay particular attention to their credit reports.

“With security events such as this one, time was taken to thoroughly investigate what occurred and identify individuals who have been affected,” said Orrantia. “Since then, the server has been secured and patient information has been restored. Health and Human Services was notified within the 60-day reporting timeframe.”

According to SecurityBoulevard.com, the hospital’s IT staff said patient information was “secured and restored” on the server as soon as they noticed a breach, which means the data could have been the victim of ransomware. 

Roosevelt General Hospital CEO Kaye Green said the ransomware removal was performed immediately upon detection and that the hospital’s electronic health record system and billing system were never affected by the breach. She also noted that they have not received any reports that patient data has been fraudulently used.

Roosevelt General is offering patients who might have been affected by the data breach to take advantage of a free credit card monitoring service, but has not shared which service they are offering or for how long patients may receive such assistance.

Healthcare Struggling with Ransomware Removal

According to HealthcareITNews.com, many healthcare facilities fail to have the money or expertise necessary to secure their data any more than is legally required. While compliance with IT security laws is important, hackers are apt to be several steps ahead of the basic firewalls.

Ransomware is a type of malware that infects a computer system and holds data hostage from the legal user by either encrypting the data or otherwise making it inaccessible until a ransom of cryptocurrency such as bitcoin is paid. In some cases, even after the ransom is paid, the healthcare provider is still denied access to its data.

HealthcareITNews talked to Tom Van de Wiele, who is a principal security consultant in cybersecurity services for F-Secure. He said when businesses pay the ransom to try to get their information back as soon as possible, the cyber thieves are encouraged to continue their criminal ways.

Van de Wiele said most ransomware attacks continue to begin at the email level. An unsuspecting employee becomes a victim of a phishing email, which allows the hacker into the system. He advised healthcare providers to increase their controls, especially with accounts that contain sensitive information and with the systems that allow employees to work remotely.

“And have a strong response strategy, including mitigating a spreading attack and ensuring back-ups are reliable and well-tested, will drastically reduce the impact of an attack,” he told HealthcareITNews.

According to antimalware company Emisoft, there were at least 966 ransomware attacks in 2019, and 764 of those were attacks on healthcare providers.

Join a Free Hospital Ransomware Attack Class Action Lawsuit Investigation

If you were a patient at a hospital or healthcare facility affected by a ransomware attack that impacted your medical care, you may qualify to join a hospital ransomware attack class action lawsuit investigation.

Learn More

This article is not legal advice. It is presented
for informational purposes only.