Atrium Health reports another data breach impacting 585k people

Atrium Health is reporting a data breach affecting 585,000 individuals through their MyAtriumHealth (formerly MyCarolinas) Patient Portal. The breach is caused by  online tracking technologies that were active between January 2015 and July 2019. These tracking tools, which were intended to improve user experience, inadvertently transmitted personal information to third-party vendors including Google and Meta (formerly Facebook).

The breach was discovered during a recent review of historical technology usage on their patient portal systems. While the tracking technologies were disabled in July 2019, the company determined it necessary to notify all users who accessed the portal during the affected period due to the uncertainty about specific data transmission patterns.

Potentially exposed data includes:

• IP addresses
• Third-party identifiers and cookies
• Treatment information (if included in URLs or button text)
• Provider information (if included in URLs or button text)
• Names (if entered in forms)
• Email addresses (if entered in forms)
• Phone numbers (if entered in forms)
• Physical addresses (if entered in forms)
• Gender information (if entered in forms)

The company explicitly claims that no Social Security numbers, financial accounts, or credit/debit card information were compromised in this incident.

The impact on individuals varied based on several factors, including their browser choice, cookie settings, whether they had accounts with the third-party vendors, and their specific actions on the platform. Atrium Health claims that there is no evidence of misuse of any shared information and believes the nature of the exposed data makes identity theft or financial harm unlikely.

This incident follows two previous security breaches at Atrium Health:

1. In April 2023, the organization experienced a phishing attack that compromised employee email accounts containing sensitive patient and employee information
2. In November 2018, they suffered a data breach through their technology solutions provider AccuDoc