Hawaii Dental Group, which trades as Hawaii Family Dental and operates about a dozen clinics from Honolulu, has begun notifying 45,853 individuals about a July intrusion in which an unauthorised third party reached systems holding patient information. Suspicious activity was identified within the company's network on 20 July, and the forensic investigation confirmed that an unauthorised party accessed its systems — including systems where patient information was stored — between 19 and 20 July. Files exposed and potentially copied included names, telephone numbers, addresses, email addresses, dates of birth, medical and dental treatment information and health insurance information; the company has told patients that financial information and Social Security numbers were not involved. Qilin, a data-theft and extortion group this digest has tracked across recent extortion cycles, claimed responsibility for the intrusion and maintains that it exfiltrated sensitive data, a claim unaccompanied in the notification by any volume figure of the company's own. The single notification arrives inside a wider wave of US healthcare filings reported in the same cycle: Life Bridges in Tennessee (5,194 individuals) after access between 17 and 22 June; Westchester Institute for Human Development in New York (938) after email-environment access between 23 March and 14 April; Community Health Care in Ohio (808) from a single compromised employee mailbox in June; and Shoshone Medical Center in Idaho (553). The pattern across all five is the one this digest has recorded repeatedly in healthcare: long dwell times in environments that cannot be taken offline, small provider-side volumes that escape attention individually, and notification arriving months after containment. Hawaii Family Dental says it is reviewing and enhancing its data privacy and security safeguards.

• Source article