19 Apr
Here’s your weekly #databreach news roundup:
McDonalds, Christie Business Holdings, Lakeview Loan Servicing, SuperCare Health, Wellstar, Snap-on, SummaCare, and Panasonic.
McDonalds
Mcdonald's fast-food customers in Costa Rica have been alerted by the company of a #databreach that accessed client private information.https://t.co/eMYhrthsR3
— DevaOnBreaches (@DevaOnBreaches) April 16, 2022
McDonalds fast food customers in Costa Rica have been alerted by the company of a data breach that accessed client private information.
In the alert sent to clients McDonalds advised that client names, marital status, address, email, document identity number and phone number had been left unprotected.
They went on to say that customers should be aware of any attempts by the criminal hackers to contact them posing as the McDonald’s company requesting further personal information, or contains malicious click invitations or to transfer funds.
In a statement to local media the company said that one of its providers had been compromised and allowed the hackers to access client information. It did not specify the location of the provider or if the criminals were able to access information of other providers in its network in Costa Rica.
Christie Clinic
Christie Clinic said the data breach occurred last year, when a third party gained unauthorized access to a single business email account, likely in an attempt to intercept financial transactions.
According to the healthcare services provider, the threat actor had access to the compromised email account between July 14 and August 19, 2021, but did not compromise other systems, electronic medical records, or the firm’s patient portal.
“The investigation indicated that the purpose of the unauthorized access was to intercept a business transaction between Christie Clinic and a third party vendor. This investigation was unable to determine to what extent email messages in the account were actually viewed or accessed by an unauthorized actor,” the company said in a data breach notice on its website.
Lakeview Loan Servicing
In December 2021, Lakeview Loan Servicing (“Lakeview”) discovered that an unauthorized third party obtained access to Lakeview’s servers and the files on those servers. In total, the data of 2,537,261 individuals were compromised in the #databreach. https://t.co/A0bHYBe5lc
— DevaOnBreaches (@DevaOnBreaches) April 14, 2022
In December 2021, Lakeview Loan Servicing, LLC (“Lakeview”) discovered that an unauthorized third party obtained access to Lakeview’s servers and the files on those servers. Between October 27, 2021 and December 7, 2021 the unauthorized third party used that access to view customer information and access private personally identifiable information.
Lakeview is the fourth-largest mortgage service company in the United States and is located in Coral Gables, Florida. It services mortgages, holds escrow, and provides customer service for over 1.5 million homeowners. Lakeview has approximately 550 employees. In total, the data of 2,537,261 individuals was compromised in the breach. If you received a data breach incident letter from Lakeview Loan Servicing, LLC, you were impacted by the breach.
SuperCare Health
SuperCare Health disclosed a #databreach that impacted more than 318,000 individuals, making it one of the year’s largest healthcare data breaches to date.https://t.co/A17KEJreZs
— DevaOnBreaches (@DevaOnBreaches) April 12, 2022
SuperCare Health in California posted a notice on its website regarding a healthcare data breach that impacted 318,379 individuals. The incident was the fourth largest reported breach on the Office for Civil Rights (OCR) data breach portal in 2022 to date, and the largest reported breach in March.
On July 27, 2021, the respiratory care provider discovered suspicious activity on its systems. SuperCare said it immediately took action to contain the incident and restore and secure its network.
Further investigation revealed that an unauthorized actor had accessed systems on SuperCare’s network between July 23 and July 27.
By February 2022, SuperCare determined that names, addresses, health insurance information, medical record numbers, birth dates, patient account numbers, claim information, treatment information, and hospital or medical group information were involved in the incident. A small number of Social Security numbers and driver’s license numbers were also involved.
“On March 25, 2022, we notified individuals whose information was involved in the incident,” SuperCare stated.
Wellstar
Wellstar notified patients after a recent #databreach, the health system announced Friday.
— DevaOnBreaches (@DevaOnBreaches) April 12, 2022
In a statement, Wellstar said there was a data security incident involving access to two Wellstar email accounts by an "unauthorized-party." https://t.co/KA3uUwryGa
Wellstar notified patients after a recent data breach, the health system announced Friday.
In a statement, Wellstar said there was a data security incident involving access to two Wellstar email accounts by an “unauthorized-party.”
“Upon learning of this issue, Wellstar promptly disabled access to the impacted email accounts and required mandatory password resets to prevent further access by unauthorized parties. Wellstar immediately commenced a prompt and thorough investigation, working closely with external cybersecurity professionals,” the health system said.
Snap-on
American automotive tools manufacturer Snap-on announced a #databreach exposing associate and franchisee data after the Conti ransomware gang began leaking the company's data in March. @LawrenceAbrams @BleepinComputer https://t.co/VD8rLY1tyD
— DevaOnBreaches (@DevaOnBreaches) April 12, 2022
American automotive tools manufacturer Snap-on announced a data breach exposing associate and franchisee data after the Conti ransomware gang began leaking the company’s data in March.
Snap-on is a leading manufacturer and designer of tools, software, and diagnostic services used by the transportation industry through various brands, including Mitchell1, Norbar, Blue-Point, Blackhawk, and Williams.
Yesterday, Snap-on disclosed a data breach after they detected suspicious activity in their network, which led to them shutting down all of their systems.
“In early March, Snap-on detected unusual activity in some areas of its information technology environment. We quickly took down our network connections as part of our defense protocols, particularly appropriate given heightened warnings from various agencies,” reads a notice on the Snap-on website.
“We launched a comprehensive analysis assisted by a leading external forensics firm, identified the event as a security incident, and notified law enforcement of the incursion.”
SummaCare
Health insurance provider SummaCare is notifying about 1,100 of its members that their information may have been involved in a data security breach. #databreachhttps://t.co/cmmTAj6iqz
— DevaOnBreaches (@DevaOnBreaches) April 12, 2022
Health insurance provider SummaCare is notifying about 1,100 of its members that their information may have been involved in a data security breach.
The Akron-based insurer, which is owned by Summa Health, said it recently investigated and addressed a data security incident involving about 2% of its 61,000 members.
The insurer said it does not believe there was any misuse of information but suggests affected members look at their statements and contact SummaCare if there are any treatments not received.
SummaCare said it became aware Feb. 8 of a misconfiguration in one of its computer systems, which allowed certain documents to be accessible via the internet between Nov. 19 and Feb. 7. The documents contained some members’ names, health insurance ID numbers, patient account numbers, dates of service, provider names and limited treatment information
“SummaCare took prompt action to remove documents and reconfigured the settings on the involved computer system,” the insurer said in a statement. “It also began a comprehensive investigation into the incident with the assistance of a third-party forensic firm.”
Panasonic
Japanese tech giant Panasonic has confirmed its Canadian operations were hit by a cyberattack, less than six months after the company last fell victim to hackers. #breach @CarlyPage_ https://t.co/X0LoYCplDt
— DevaOnBreaches (@DevaOnBreaches) April 12, 2022
Japanese tech giant Panasonic has confirmed its Canadian operations were hit by a cyberattack, less than six months after the company last fell victim to hackers.
In a statement provided to TechCrunch, Panasonic said that it was a victim of a “targeted cybersecurity attack” in February that affected some of its systems, processes and networks.
“We took immediate action to address the issue with assistance from cybersecurity experts and our service providers,” said Panasonic spokesperson Airi Minobe. “This included identifying the scope of impact, containing the malware, cleaning and restoring servers, rebuilding applications and communicating rapidly with affected customers and relevant authorities.”