Premier Medical Group Breach Exposes 282,075 Patient Records

Premier Medical Group notified 282,075 patients that attackers accessed certain files on June 14, exposing names, contact information, dates of birth, treatment and diagnostic details, medication records, health insurance information, dates of service, provider names and internal patient identification numbers.

The New York provider operates multiple offices in the Hudson Valley and offers cardiology, dermatology, gastroenterology, neurology, plastic surgery, gynecology and internal medicine. PMG reported that some systems were disrupted during the incident and its investigation identified the June 14 access to patient files.

PMG informed affected patients and reported the incident to the U.S. Department of Health and Human Services. HHS added the incident to its public data breach portal this week.

PMG has not disclosed how attackers gained access, whether data were copied or removed, or who is responsible. No public claims of responsibility by known ransomware or extortion groups have emerged. The provider did not specify whether the attack involved ransomware, phishing, a network intrusion or another method.

In its notification to patients, PMG wrote: “We recommend that patients review the statements they receive from their healthcare providers and health insurance plan. If they see any services that were not received, patients should contact their provider or health plan immediately.”

PMG did not state whether affected individuals will be offered credit monitoring or identity protection services, and it has not provided a timeline for restoring disrupted systems or completing security upgrades.

Regulators and security observers track health care breaches involving multi-specialty practices because such records can include both personal identifiers and detailed medical information. The HHS breach portal will reflect any future updates if PMG provides further information on root cause, scope or corrective actions.