3C Care Systems Data Breach: 100GB of Patient Data Reportedly Stolen

3C Care Systems, a healthcare IT company specializing in workflow automation and augmentation solutions for medical organizations, experienced a ransomware attack that compromised data belonging to patients of at least one of its healthcare clients, Midwest Spine and Brain Institute.

3C Care Systems develops software and intelligent systems designed to automate and optimize healthcare workflows for hospitals, clinics, imaging centers and radiology groups. Because 3C Care Systems provides managed IT services to healthcare organizations, the breach had the potential to affect patients at multiple providers that rely on its systems.

According to the notice posted to Midwest Spine and Brain Institute's website, 3C Care Systems was affected by an external cyberattack.

RansomHub, a ransomware group, posted its claim on the dark web, stating it had obtained 100 gigabytes of data from 3C Care Systems and intended to publish the data within nine to 10 days.

Upon learning of the issues with 3C Care Systems, Midwest Spine and Brain Institute opened an investigation with the assistance of external professionals experienced in handling these types of cybersecurity incidents. The goal of the investigation was to assess the full scope of information impacted by the breach.

3C Care Systems also conducted its own independent forensic investigation with the help of cybersecurity professionals.

A review of 3C Care's affected systems determined that the types of information potentially exposed included first and last names, dates of birth, medical treatment information, procedure and diagnosis information, medical record numbers, medical provider information, medical prescription information, dates of service and health insurance claim and policy information.

The potentially impacted data could include both protected health information (PHI) and personally identifiable information (PII). The types of information varied by individual, and not all data elements were affected for each person.

Response to the 3C Care Systems data breach

Individuals linked to Midwest Spine and Brain Institute can reach out to the institute to inquire about the incident by email at HIPAA@midwestspine.net.

At this time, 3C Care Systems has not released a public statement about the incident. Individuals who believe they may have been impacted should remain vigilant and review their accounts for any suspicious activity.