Carespring Data Breach Investigation
The Lyon Firm is a Cincinnati, Ohio data breach lawyer investigating claims of an alleged ransomware attack on Carespring, which could potentially impact thousands of individuals. The investigation is ongoing, and new details will be reported as soon as they are confirmed or denied by Carespring.
Update on Carespring Data Breach
Over 76,000 individuals may have had their personal information compromised by the data breach, as reported by the Maine Attorney General. The Loveland, Ohio healthcare organization, which specializes in senior living care, skilled nursing, rehabilitation, nursing homes, independent living, assisted living, hemodialysis nursing care, and memory care facilities.
According to letters sent to impacted patients and employees, on October 28, 2023, Carespring detected suspicious activity on its IT network. After an initial investigation, they determined that sensitive personal information on its systems may have been viewed and stolen between October 12 and October 28, 2023. The type of information potentially leaked could include the following:
- Name
- Social Security number
- Address
- Driver’s license number
- Passport number
- Tax identification number
- Financial information
- Credit card information
- Medical information
- Health insurance information
What Happened at Carespring?
The NoEscape ransomware gang claims to have recently hit two medical entities: Southeastern Orthopaedic Specialists, P.A. in North Carolina, and Carespring, a healthcare organization that provides skilled nursing, memory care, rehabilitation, and independent or assisted living options throughout Loveland, Cincinnati, Dayton, and Northern Kentucky.
According to NoEscape, they locked up Carespring’s files on November 10, 2023 and exfiltrated 364 GB of files that may include personal data of employees and patients, and medical records.
NoEscape, believed to be a successor of Avaddon, a ransomware group that was shut down in 2021, first emerged in May 2023 and has already made a name for itself by using aggressive tactics to extort victims. NoEscape is labeled as a Ransomware-as-a-Service (RaaS) group by cybersecurity experts and has been seen encrypting files on a victim’s computer and demanding ransoms, as well as providing information and assistance to other cybercriminals.
It is important to note again that Carespring has not confirmed any data breach at this point and NoEscape has not posted any actual proof of these serious claims. The Lyon Firm will continue to update news of any ransomware attack developments related to Carespring in Loveland, Ohio.