Joslin Diabetes Center

Joslin Diabetes Center notified individuals of a third-party vendor (Blackbaud) ransomware incident. Blackbaud discovered the incident in May 2020, encrypted systems, and potentially exported data before locking the actor out on May 20, 2020. Joslin was notified in July 2020. Data potentially included names, DOBs, and treatment info. No SSNs or financial data were hosted by Blackbaud for Joslin. Joslin is reviewing vendor policies.

Joslin Diabetes Center notified Washington AG of a third-party ransomware incident involving vendor Blackbaud. Unauthorized access occurred between Feb 7 and May 20, 2020. Joslin discovered the incident on July 16, 2020, upon notification from Blackbaud. 1,212 Washington residents affected; data included names, DOBs, and medical info. Blackbaud systems were encrypted; data potentially exfiltrated before containment.

Joslin Diabetes Center notified individuals of a ransomware incident affecting third-party vendor Blackbaud, Inc. discovered by Blackbaud in May 2020. A cybercriminal may have accessed or exported donor/patient data including names, dates of birth, treatment dates and locations, and physician names. Financial account information and SSNs were not involved. Approximately 1,453 Rhode Island residents were potentially affected.

Joslin Diabetes Center reported to HHS on 2020-09-14 a Hacking/IT Incident affecting 71,160 individuals. A business associate experienced a ransomware attack affecting electronic protected health information (ePHI) located on a network server. The ePHI included names, addresses, email addresses, gender, dates of birth, and treatment information. The Center notified HHS, affected individuals, and the media.