The IT Nerd

The New York Blood Center, one of the world’s largest independent blood collection and distribution organizations, says a Sunday ransomware attack forced it to reschedule some appointments.

Here’s what happened:

On Sunday, January 26, New York Blood Center Enterprises and its operating divisions identified suspicious activity affecting our IT systems. We immediately engaged third-party cybersecurity experts to investigate and confirmed that the suspicious activity is a result of a ransomware incident. We took immediate steps to help contain the threat and are working diligently with these experts to restore our systems as quickly and as safely as possible. Law enforcement has been notified.

We understand the critical nature of our services, and the health of our communities remains our top priority. We remain in direct communication with our hospital partners and are implementing workarounds to help restore services and fulfill orders.

Paul Bischoff, Consumer Privacy Advocate at Comparitech, commented: 

“Ransomware gangs don’t discriminate between charitable organizations and for-profit companies. Medical organizations are frequently targeted because they can’t operate for long without their computer systems, and those systems store a lot of sensitive patient and employee data. That makes hospitals and clinics more likely to pay ransoms. Furthermore, hospitals employ a lot of non-IT staff that attackers can phish.”

For the second time today, I am writing about a health care organization who has been pwned. Seriously, the fact that this sector is pretty much easy prey for threat actors needs to change. And it needs to change right now.

In a Thursday filing, non-profit, Connecticut healthcare provider Community Health Center (CHC) disclosed that it started notifying over 1 million patients of a data breach that impacted their personal and health data.

CHC said in the notice that a breach was discovered on January 2, 2025, two months after the unknown attackers gained access to its network in mid-October.

While the breach didn’t impact its operations, the threat actors stole files containing patients’ personal and health information belonging to 1,060,936 individuals.

“Fortunately, the criminal hacker did not delete or lock any of our data, and the criminal’s activity did not affect our daily operations. We believe we stopped the criminal hacker’s access within hours, and that there is no current threat to our systems,” CHC said.

Stolen data includes a combination of:

• Names
• DOBs
• Contact Information
• SSNs
• Medical diagnoses
• Treatment details
• Test results 
• Health insurance details

In response to the incident, CHC said it has strengthened its security and added special software to “watch for suspicious activity” and working to make sure patient information “stays safe in the future.”

Emily Phelps, Director, Cyware:

  “Incidents in this sector underscore the ongoing risks healthcare providers face, with attackers gaining access to sensitive data like names, medical diagnoses, and insurance details. This incident highlights the urgency of securing healthcare infrastructures—protecting not just patient data, but the broader ecosystem of communication, collaboration, and care delivery. Strengthening threat intelligence management and automating security processes are essential steps in reducing vulnerabilities and enhancing defenses. Effective information sharing and a collective defense approach are critical in safeguarding healthcare organizations from these growing threats.”

Sometimes I feel like I am a broken record. But the healthcare sector needs to do better. Getting pwned on a constant basis is something that simply must not continue. It needs to be addressed as an urgent problem. And I have to be honest, I don’t know if that sector really takes this problem seriously.

UPDATE: Erich Kron, Security Awareness Advocate at KnowBe4 adds this: 

“The repeated successful attacks against healthcare organizations have become a very frustrating problem both for organizations and for the individuals caught up in the breaches. The medical industry collects and stores some of the most sensitive information individuals have, including specific medical diagnoses, treatments, medications, and other information that most people don’t want in the public eye. Unfortunately, these medical facilities are targeted consistently and seem to be struggling to defend themselves.”

“For a long time, the healthcare industry has struggled with balancing costs and expenses, while hiring enough employees to ensure high levels of service to their patients. The most common way for bad actors to spread ransomware, or make initial network intrusions successful, is by targeting the employees within these organizations. Unfortunately, many healthcare organizations remain understaffed, and their staff can be overworked, leading to errors and mistakes simply through fatigue and ongoing stress, adding to the risk of an incident.”

“For organizations in these industries, it is critical that the human risk is addressed in their cybersecurity plans, and that employees are given the education, tools, and resources they need to defend themselves against bad actors. Employees need to be able to quickly and efficiently spot and report suspected social engineering attacks to teams within their organization, allowing them to continue their work with the least amount of disruption. This industry has proven to be a significant challenge when it comes to securing information, but clearly, we must focus on improving the protection of this sensitive patient information.”