Inova Health hit by third-party data breach, letters sent to patients possibly impacted
WASHINGTON (ABC7) — Inova Health Systems mailed letters to patients informing them of a data security breach that may have caused their personal information to be compromised.
The data breach involves Blackbaud, a third-party service provider used for fundraising and alumni or donor efforts at non-profits and universities worldwide.
Blackbaud was the target of a ransomware attack that took place between February and May of this year.
ALSO READ: A new hospital is in the works for Fairfax County as Inova looks to expand
Inova released a statement saying in part that hackers obtained some of the personal information of patients and donors.
Social security numbers and financial account information was not impacted. But ransomware attackers may have obtained patients' names, addresses, phone numbers, and medical departments they visited.
ALSO READ: Inova Health Foundation sees $1 million and record amount of protection equipment donated
Inova sent out letters to thousands of patients and is asking anyone who has questions to visit the Inova Health website and to also be sure to check your credit report.
Here is Inova's full statement on the Blackbaud data breach:
Inova Health System was notified by Blackbaud, a third-party service provider used for fundraising and alumni or donor engagement efforts at non-profits and universities worldwide, about a wide-reaching data security incident impacting Inova Health System and many of Blackbaud's clients across the world. Blackbaud was the target of a ransomware attack that occurred between February 7, 2020 and May 20, 2020. As a result of this incident, hackers obtained some of the personal information of our patients and donors. Blackbaud has assured us that they closed the vulnerability that allowed the incident, and that they are enhancing their security controls and conducting ongoing efforts against incidents like this in the future. According to Blackbaud, there is no evidence to believe that any data will be misused, disseminated, or otherwise made publicly available.
Inova takes the security of personal information very seriously. Once we were informed of the incident by Blackbaud, we immediately commenced a thorough investigation, in partnership with leading cybersecurity professionals, to determine who may have been affected, and to notify them. Importantly, this incident does not impact Social Security numbers, financial account information and/or payment card information.
