3.7 Million Patients of Banner Health are the Latest Victims of a Healthcare-Related Breach

The healthcare industry is one of the prime targets for hackers. This is because the data is so valuable on the dark web. Another victim of a breach, Banner Health announced that 3.7 million individuals will be receiving notice that their information was breached in a “sophisticated cyberattack” against the organization. Information stolen includes card numbers, expiration dates, verification codes, and cardholder names.

The company stated that attackers gained access to payment card processing systems within the organization’s food and beverage outlets. As a result of this, they also gained access to other healthcare-related information; although Banner Health has not stated how that occurred. According to a statement by the organization, the unauthorized access affects those using payment cards at any of their locations between June 23 and July 7, when the breach was discovered. However, they also stated that the attack was initiated on June 17.

Patients or anyone visiting a location and making a purchase in a cafeteria, gift shop, or other outlet within the Banner system should check payment card statements and charges closely for the next year. If anything looks suspicious, contact the card issuer to get it resolved. Remember that if there is ever an option at a payment terminal to use the card as debit or credit, choose the credit option. This won’t prevent the card from being used fraudulently, but it will prevent someone from using it at an ATM to drain your bank account.

Banner also disclosed that on July 13, it learned in addition to the payment card details, “cyberattackers may have gained unauthorized access to patient information, health plan member and beneficiary information, as well as information about physician and healthcare providers.” The information exposed is a long list and includes patient names, birthdates, addresses, clinical details, claims information and possibly social security numbers, in addition to other information. Therefore, all Banner patients should be sure to check credit reports from all three major credit bureaus diligently over the next year. Everyone with credit in the U.S. is entitled to one free from each of them (Experian, Equifax, and TransUnion) each year. If you order one each quarter, you can more quickly react to anything that is incorrect. There is a government-backed website that ensures you will get your free annual credit reports at no charge. If you are required to put in payment details, it may not be the correct site. Be sure to read the fine print though. You will probably still be asked to “upgrade” your request, but it isn’t necessary.

Banner health is also offering free credit and identity theft monitoring services for the next year. If it is offered, take advantage of it. It will not prevent fraudulent charges or identity theft, but it will alert you when someone is trying to access your credit report.

For organizations charged with taking care of patients, it’s not enough any longer to just pay attention to HIPAA regulations. It is also increasingly important to increase the attention given to PCI compliance as well. If a breach at the point-of-sale (POS) system occurs, it’s much easier for an intruder to get into the more valuable healthcare data. Credit card details are for sale on the dark web for about a dollar each, social security numbers that are not easily changed are far more valuable. Prices for everything on the dark web fluctuate according to supply and demand, but social security numbers can net a criminal up to $30 each as part of a full dossier on an individual. If they retrieved 3.7 million of this from Banner, that’s a lot of dough.

Banner joins an ever-expanding list of organizations in the healthcare sector that have been breached. Other notable ones include Anthem, Partners Healthcare, and Excellus BlueCross BlueShield among many others.