Watsonville Community Hospital employees report identity theft following cyber attack
Learn More
Approximately 20 employees at Watsonville Community Hospital report being victims of identity theft, just months after the healthcare facility suffered a cyber attack. These employees have discovered fraudulent tax returns filed in their names, according to hospital spokeswoman Nancy Gere.
"We heard from a few of our employees that they reported there were fraudulent tax filings in their name, so someone else had tried to file a tax return in their name and they had received that notification from the IRS," Gere stated.
One employee reports that before she had filed her tax return, she logged into her IRS account and discovered an $8,000 refund being processed. She noted that IRS agents flagged the suspicious refund, preventing its disbursement.
The hospital first reported a cyber attack on November 29, 202 and a month later, on December 31, 2024, they posted a substitute notice revealing that a "recent data security event" was still under investigation. According to this notice, files containing sensitive information may have been accessed, including:
- Patient names
- Dates of birth
- Social Security numbers
- Passport numbers
- Diagnosis information
While the hospital did not confirm whether this was a ransomware attack, a threat actor group known as "Termite" added Watsonville Community Hospital to its dark web leak site on December 11, 2024. Intelligence firms monitoring Termite have described it as a ransomware group using an older version of Babuk ransomware.
Termite's leak site, last updated on January 8, 2025, included proof of their claims with screenshots of what appears to be:
- A highly sensitive personnel-related file
- A patient-related file
- A patient-related spreadsheet
The number of affected individuals is not disclosed. It's not clear whether the hospital has notified the impacted individuals, and why hasn't the hospital complied with state and HIPAA requirements for timely notification
