Radiology group cyberattack exposes private info of over 150,000 patients

A radiology provider in Kentucky informed more than 150,000 patients that their personal identifying information may have been exposed during a recent cyberattack. 

On June 13, Central Kentucky Radiology (CKR) began sending letters to affected patients detailing an attack on one of the practice's internal systems, which occurred last fall. After completing an investigation in May, CKR determined that a third party gained access to certain systems within its network between Oct. 16–18. 

“While we are unaware of any actual or attempted fraudulent misuse of your information as a result of this incident, we are notifying you out of an abundance of caution,” the message read. 

The information exposed during the attack included names, addresses, dates of birth, Social Security numbers and service charges. CKR estimates that up to 167,000 individuals may have been affected by the leak. 

In addition to notifying patients, CKR also alerted the appropriate authorities, including the United States Department of Health and Human Services, about the incident. So far, the practice has not uncovered evidence indicating the information exposed has been used maliciously. The group is covering credit monitoring to all affected individuals for 12 months. 

“Additionally, CKR is providing impacted individuals with guidance on how to better protect against identity theft and fraud, including advising individuals to report any suspected incidents of identity theft or fraud to their credit card company and/or bank,” CKR told the Maine Attorney General’s Office. 

Since the attack took place, Central Kentucky Radiology says it also has implemented additional  cybersecurity measures to help prevent future data breaches. 

“We take this incident and the security of personal information in our care seriously,” the letter to the AG states. “Upon discovering the unauthorized activity, we took steps to further increase the security of our systems and investigated the activity.” 

To date, no groups have come forward to take credit for the attack. Central Kentucky Radiology, PLLC, is based in the community of Lexington, and employs a team of around 20 board-certified physicians.