Ransomware Encrypts Email at Warsaw Clinic Network; Patient Data Exposure Possible
Summary
Ransomware encrypted email correspondence at Warsaw clinic network SPZOZ Warszawa-Ursynów. The provider says patient and other data may have been copied, but this remains unconfirmed as forensic analysis continues.
Key points
- SPZOZ Warszawa-Ursynów reported the cyberattack on September 2; its email server was breached and ransomware encrypted stored correspondence.
- The provider cannot rule out that attackers copied or disclosed email contents and attachments; no further use of potentially stolen data has been identified so far.
- Potentially affected patient information includes names, PESEL numbers, contact details, addresses and health data, including referrals, test results and medical documents.
- The provider isolated the affected mail server, is conducting forensic analysis and notified Poland's data protection authority and other relevant state bodies.
- The provider recommends affected people reserve their PESEL number, consider credit alerts, check exposed personal information online and use two-factor authentication.
- For organizations, the article recommends encrypting documents and sharing passwords through a separate channel, not using a PESEL number as the password.
Article Details
- Victim Organization
- SPZOZ Warszawa-Ursynów
- Incident Type
- Ransomware attack targeting an email server; stored email correspondence was encrypted. Possible data copying or disclosure remains unconfirmed.
- Data Types Exposed
- Names
- PESEL numbers
- Dates of birth
- Residential or temporary addresses
- Telephone numbers
- Private email addresses
- Health data, including referral scans, laboratory results, patient complaints, medical certificates and opinions, and requests concerning medical records
- Potentially, work-related or settlement information transmitted by email
- Affected Records
- Unknown; the source says the incident could potentially affect all information transmitted by email.
- Operational Impact
- Stored email correspondence was encrypted. The affected email server was secured and isolated from the network while forensic analysis continued.
- Ransom Or Extortion
- None reported.
- Claim Status
- confirmed