East Valley Community Health Center, Inc.

East Valley Community Health Center, Inc. experienced a ransomware attack on October 18, 2016, when an unknown individual accessed a server and installed Troldesh/Shade malware, encrypting files containing patient health information. Affected data included names, dates of birth, addresses, medical record numbers, health diagnosis codes, and insurance account numbers. Social security numbers and driver's license numbers were not involved. The organization notified regulators and affected patients in December 2016.

On October 18, 2016, an unknown individual logged into East Valley Community Health Center, Inc.'s network server without authorization and installed Troldesh/Shade ransomware, encrypting stored files. Claims data for 65,000 patients transmitted to a clearinghouse was exposed, including names, dates of birth, addresses, medical record numbers, health diagnosis codes, and insurance account numbers. The CE notified HHS, affected individuals, and media, and revised its Security Rule policies following OCR investigation. Breach submitted to HHS on 2016-12-15.

Affected (this filing): 65,000