Hawaii Radiologic Associates, Ltd.

The Vermont Office of the Attorney General disclosed a data breach affecting Hawaii Radiologic Associates, Ltd. between August 20–25, 2024, reported on November 6, 2024. The incident exposed sensitive personal and medical data, including individuals' names, dates of birth, health insurance subscriber IDs, and types of medical exams conducted. The exact number of affected individuals remains undetermined, raising concerns over potential identity theft, insurance fraud, or targeted phishing attacks leveraging the compromised health-related information. As a healthcare provider, the breach poses risks beyond financial harm, potentially enabling malicious actors to exploit medical histories for fraudulent claims or blackmail. The exposure of health insurance details and exam types further heightens privacy violations, given the sensitivity of medical records. While no ransomware or direct financial theft was reported, the unauthorized access to such data aligns with patterns seen in healthcare-targeted cyber intrusions, where patient confidentiality is critically compromised. The breach underscores vulnerabilities in safeguarding protected health information (PHI), necessitating regulatory scrutiny under laws like HIPAA. The lack of clarity on the attack vector (e.g., phishing, unpatched systems) leaves open questions about preventive measures and the organization’s cybersecurity posture.

Source: https://ago.vermont.gov/document/2024-11-06-hawaii-radiologic-associates-data-breach-notice-consumers

TPRM report: https://www.rankiteo.com/company/hawaii-diagnostic-radiology-services

"id": "haw038090625",
"linkid": "hawaii-diagnostic-radiology-services",
"type": "Breach",
"date": "8/2024",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': 'Unknown',
                        'industry': 'Healthcare',
                        'location': 'Hawaii, USA',
                        'name': 'Hawaii Radiologic Associates, Ltd.',
                        'type': 'Healthcare Provider'}],
 'data_breach': {'number_of_records_exposed': 'Unknown',
                 'personally_identifiable_information': True,
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Personal Identifiable '
                                              'Information (PII)',
                                              'Protected Health Information '
                                              '(PHI)']},
 'date_publicly_disclosed': '2024-11-06',
 'description': 'The Vermont Office of the Attorney General reported a data '
                'breach involving Hawaii Radiologic Associates, Ltd. The '
                'breach occurred between August 20, 2024, and August 25, 2024, '
                "potentially affecting individuals' names, dates of birth, "
                'health insurance subscriber IDs, and types of exams.',
 'impact': {'data_compromised': ['Names',
                                 'Dates of birth',
                                 'Health insurance subscriber IDs',
                                 'Types of exams'],
            'identity_theft_risk': 'Potential'},
 'investigation_status': 'Ongoing (number of affected individuals unknown)',
 'references': [{'date_accessed': '2024-11-06',
                 'source': 'Vermont Office of the Attorney General'}],
 'regulatory_compliance': {'regulations_violated': ['Potentially HIPAA (Health '
                                                    'Insurance Portability and '
                                                    'Accountability Act)'],
                           'regulatory_notifications': ['Vermont Office of the '
                                                        'Attorney General']},
 'title': 'Data Breach at Hawaii Radiologic Associates, Ltd.',
 'type': 'Data Breach'}