St. Joseph's/Candler Health System, Inc.

St. Joseph’s/Candler disclosed a ransomware incident where unauthorized access occurred between Dec 18, 2020 and Jun 17, 2021. The attacker encrypted files and potentially accessed patient/employee PII including SSNs, medical records, and financial data. SJ/C isolated systems, engaged forensic firms, notified law enforcement, and offered 1-year Experian IdentityWorks.

St. Joseph's/Candler Health System, a Georgia-based healthcare provider, reported a ransomware attack affecting PHI of approximately 1,400,000 individuals. Affected data included names, addresses, dates of birth, driver's license and Social Security numbers, claims information, and diagnoses. The CE notified HHS, affected individuals, and the media; provided substitute notice; offered complimentary credit monitoring; and implemented additional administrative, technical, and security safeguards. Data was located on a network server. No business associate was reported.

St. Joseph's/Candler Health Services reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2019-06-05. 2 Massachusetts residents were affected. The report records the breach type as electronic.