ESO Solutions discloses a ransomware attack compromising 2.7 million patient records.
ESO Solutions, a provider of healthcare and fire department software, revealed a ransomware attack compromising data from 2.7 million patients. Hackers exfiltrated data on September 28 before encrypting company systems. ESO Solutions found unauthorized access to a machine containing sensitive information during the investigation.
On October 23, the company confirmed the breach’s impact on patients linked to U.S. hospitals and clinics. Exposed data includes full names, birth dates, phone numbers, medical record numbers, injury details, diagnoses, treatments, procedures, and Social Security Numbers (SSNs). The extent of exposed information varies per individual.
ESO Solutions notified the FBI and state authorities. All affected customers were informed on December 12, with some hospitals notifying patients soon after. The patient notification states no evidence of information misuse. To address the breach risk, ESO offers 12 months of identity monitoring through Kroll to all notice recipients.
Confirmed impacted healthcare providers include Mississippi Baptist Medical Center, Community Health Systems Merit Health Biloxi, Merit Health River Oaks, ESO EMS Agency, Forrest Health Forrest General Hospital, HCA Healthcare Alaska Regional Hospital, Memorial Hospital at Gulfport Health System, Providence St Joseph Health, Providence Alaska Medical Center, Universal Health Services (UHS) Manatee Memorial Hospital, Desert View Hospital, Ascension Providence Hospital in Waco, Tallahassee Memorial, Manatee Memorial Hospital, and CaroMont Health.
As of now, no ransomware group has claimed responsibility for the ESO attack. Unfortunately, these supply-chain breaches are increasingly common in healthcare, risking patient data and threatening the stability of medical institutions.
Related stories:
