SAN DIEGO — Scripps Health is working to notify more than 147,000 people about a data breach tied to the recent ransomware attack.
Scripps first started looking into the cyberattack in early May. The San Diego-based nonprofit system took a large portion of its network offline as a protective measure, resulting in rescheduled appointments for patients and some uncertainty for its staff.
On Tuesday, Scripps said an investigation into the attack determined an unauthorized person gained access to their network and acquired copies of some documents before deploying ransomware. Scripps said the hacker did not access Scripps’ electronic medical record application, Epic, but health information and personal financial information was acquired through other documents stored in the network.
The company said in a Tuesday news release that they’ve determined the documents contained patient information. They are now mailing notification letters to approximately 147,267 individuals so they can take steps to protect their information.
“For the less than 2.5% of individuals whose Social Security number and/or driver’s license number were involved, we will be providing complimentary credit monitoring and identity protection support services. At this point, we have no indication that any of this data has been used to commit fraud,” the news release said.
Scripps said the investigation into the cyberattack continues and they don’t yet know the content of the remainder of documents they believe are involved.
“We have kicked off an extensive manual review of those documents. This is a time intensive process that will likely take several months, but we will notify affected individuals and entities as quickly as possible in accordance with applicable regulatory requirements,” the company said.
The health care system’s electronic health record is back online and patients can again log into their MyScripps accounts to view information and schedule appointments.
But some patients tell FOX 5 the provider remains so overwhelmed with backlogged requests that they are still outsourcing services.
Employees who work in business support offices are also unsure when they will get their paychecks. Many were told they could either use their paid time off or go without pay during the last month while everything remained offline.
Patients with questions were advised to contact a dedicated call center at 855-535-1822. It is available Monday through Friday from 6 a.m. to 6 p.m.