PracticeSuite, Inc.

On October 11, 2024, PracticeSuite, Inc. suffered a data breach exposing a file containing protected health information (PHI) of 13,353 individuals. The compromised data included names, Social Security numbers, and medical records, creating a high risk of identity theft and financial fraud. Unauthorized actors gained access to the system, though the exact method (e.g., phishing, exploit) was not disclosed. In response, the company offered two years of Experian credit monitoring and identity theft protection to affected individuals. The breach underscores vulnerabilities in handling sensitive healthcare data, potentially leading to long-term reputational damage, regulatory scrutiny (e.g., HIPAA violations), and financial liabilities from lawsuits or fines. The exposure of SSNs and medical histories elevates the severity, as such data is highly valuable on dark web markets and can facilitate medical identity theft, fraudulent insurance claims, or targeted scams.

Source: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/5f9f74de-7add-49c7-bab5-533f7fbc243d.html

TPRM report: https://www.rankiteo.com/company/practicesuite-inc-web-based-medical-billing-and-practice-management-software

"id": "pra717090125",
"linkid": "practicesuite-inc-web-based-medical-billing-and-practice-management-software",
"type": "Breach",
"date": "10/2024",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '13,353 individuals',
                        'industry': 'Healthcare (Medical Practice Management '
                                    'Software)',
                        'name': 'PracticeSuite, Inc.',
                        'type': 'Organization'}],
 'customer_advisories': ['Identity theft protection services offered (2 years '
                         'of Experian credit monitoring)'],
 'data_breach': {'data_exfiltration': 'Yes (unauthorized access to data file)',
                 'number_of_records_exposed': '13,353',
                 'personally_identifiable_information': ['names',
                                                         'Social Security '
                                                         'numbers'],
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Protected Health Information '
                                              '(PHI)',
                                              'Personally Identifiable '
                                              'Information (PII)']},
 'date_detected': '2024-10-11',
 'description': 'The Maine Office of the Attorney General reported that '
                'PracticeSuite, Inc. experienced a data breach on October 11, '
                '2024, affecting 13,353 individuals. The breach involved '
                'unauthorized access to a data file containing protected '
                'health information, including names, Social Security numbers, '
                'and medical information. Identity theft protection services, '
                'including two years of Experian credit monitoring, were '
                'offered to affected individuals.',
 'impact': {'data_compromised': ['names',
                                 'Social Security numbers',
                                 'medical information'],
            'identity_theft_risk': 'High (PII and PHI exposed)'},
 'references': [{'source': 'Maine Office of the Attorney General'}],
 'regulatory_compliance': {'regulations_violated': ['Potential HIPAA violation '
                                                    '(PHI exposure)'],
                           'regulatory_notifications': ['Maine Office of the '
                                                        'Attorney General']},
 'response': {'remediation_measures': ['Offered identity theft protection (2 '
                                       'years of Experian credit monitoring)']},
 'title': 'PracticeSuite, Inc. Data Breach (October 2024)',
 'type': 'Data Breach'}