According to Planned Parenthood, the latest data breach has affected its Los Angeles branch (PPLA) after it suffered a ransomware attack.
On Wednesday, December 1st, 2021 Planned Parenthood, the non-profit reproductive health care organization based in the United States disclosed a data breach impacting over 400,000 patients of its Los Angeles branch (Planned Parenthood Los Angeles (PPLA). Hackers steal 400,000 patients’ records.
Planned Parenthood ransomware attack
Although at this time no group has claimed responsibility for the attack, the data breach took place as a result of a ransomware attack, Planned Parenthood’s spokesperson John Erickson told The Washington Post which was the first publication to break the story.
Erickson further revealed that threat actors installed a malicious piece of software on one of the organization’s servers and extracted files between Oct. 9 and Oct. 17, 2021.
It is worth noting that ransomware attacks have become a major threat to critical infrastructure around the world including gas pipelines, defense contractors, police stations, etc.
According to [PDF] the data breach notification sent by Planned Parenthood to affected patients, the organization has informed law enforcement and taking help from a third-party cyber security company.
Stolen data
As of now, authorities are investigating the incidents however initial analysis of the breach indicates that the hackers managed to steal the following information:
- Names
- Addresses
- Date of birth
- Insurance information
- Clinical information including diagnosis, procedure, and/or prescription information.
If you are one of the victims, Planned Parenthood is advising you to take precautionary measures by “reviewing statements you receive from your health insurer and health care providers. If you see charges for services you did not receive, please call the insurer or provider immediately.”
Previous cyberattacks
This is not the first time when Planned Parenthood has suffered a cyber attack. In fact, in July 2015, the organization suffered a series of massive DDoS attacks from anti-abortion attackers. The attacks forced Planned Parenthood’s website to go offline.
In July 2015 again, Planned Parenthood suffered yet another cyber attack in which anti-abortion hackers exploited a Blind SQL vulnerability to steal sensitive data before leaking it online.
3 major data breaches in a couple of weeks
Cyber attacks against US-based firms are at their peak. On November 22nd, 2021, the Scottsdale, Arizona-based web registrar and hosting firm GoDaddy disclosed that it suffered a data breach in which the personal details plus login credentials of up to 1.2 million active and inactive customers were accessed by an “unauthorized third party.”
On December 1st, 2021, the Fairfield, Ohio-based DNA testing service DNA Diagnostics Center (DDC) disclosed a data breach in which sensitive personal and financial data of more than 2.1 million (2,102,436) customers/users was stolen.
