Medical Healthcare Solutions, Inc.

Medical Healthcare Solutions, Inc. (MHS) disclosed a ransomware attack discovered on November 19, 2021. The threat actor accessed MHS' network using stolen credentials from a third-party vendor via RDP between October 1-4, 2021, encrypting files and exfiltrating PHI. MHS refused the ransom, restored systems from backups, and notified the FBI. The breach affected 2,929 New Hampshire residents, exposing names, SSNs, DOBs, and medical records. MHS implemented MFA, restricted IP access, and offered 24 months of credit monitoring.

Medical Healthcare Solutions, Inc. reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2022-01-24. 118,417 Massachusetts residents were affected. The report records the breach type as electronic.

Medical Healthcare Solutions, Inc. (MA, Business Associate) reported to HHS OCR on 2022-01-22 a ransomware incident affecting 133,997 individuals via a Network Server. Exposed PHI included names, SSNs, driver's license numbers, addresses, dates of birth, diagnoses, lab results, medications, and financial/claims information. The BA notified HHS, affected individuals, and media; provided substitute notice; offered credit monitoring; and implemented enhanced safeguards including staff retraining.

Medical Healthcare Solutions, Inc. (MHS) disclosed a ransomware incident where an unauthorized party accessed its network via RDP using stolen third-party vendor credentials between Oct 1-4, 2021. MHS discovered the incident on Nov 19, 2021. The attacker encrypted files, exfiltrated PHI including SSNs, financial data, and medical records, and published data on a dark web blog. MHS refused the ransom, restored systems from backups, and notified the FBI. Approximately 133,997 individuals were affected. MHS offered 24 months of credit monitoring and implemented MFA and network restrictions.

MEDICAL HEALTHCARE SOLUTIONS filed a data-breach notice with the Illinois Attorney General during 2022 (case 2022-034). The register records the breach as discovered on November 19, 2021. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.