Ascension, one of the largest private healthcare systems in the U.S., is alerting nearly 5.6 million patients and employees that their personal and health data were stolen in a cyberattack linked to the Black Basta ransomware group in May.
The breach, which affected Ascension’s electronic health records system and other critical operations, is now prompting the company to send notification letters to 5,599,699 individuals. Starting December 19, Ascension is also offering affected individuals 24 months of free IDX identity theft protection services, which include CyberScan monitoring and a $1 million insurance reimbursement policy.
The cyberattack, detected on May 8, was reportedly caused by an employee who inadvertently downloaded a malicious file, which Ascension describes as likely an “honest mistake.” The stolen data includes sensitive information such as names, medical records, payment details, Social Security numbers, insurance information, and more.
In its breach notification, Ascension stated that it immediately launched an investigation with the help of cybersecurity experts and alerted law enforcement agencies, including the FBI and CISA. The company has since confirmed that the stolen files contained varying types of personal and health information for different individuals.
The ransomware attack severely disrupted operations, forcing the healthcare provider to take devices offline, divert emergency services, and postpone some non-urgent procedures. Employees had to rely on manual record-keeping after losing access to electronic health records.
While Ascension has not officially named Black Basta as the perpetrator, CNN and other sources have linked the ransomware group to the breach. Black Basta, which has targeted numerous high-profile organizations since its emergence in 2022, has reportedly extorted over $100 million from more than 90 victims to date.
Ascension operates 140 hospitals and 40 senior care facilities nationwide, with a reported revenue of $28.3 billion in 2023. The breach underscores the growing threat ransomware poses to the healthcare sector, with Black Basta accelerating its attacks against healthcare organizations in recent months.
