Kootenai Health notifies 464K people of data breach that exposed SSNs, medical info

Kootenai Health yesterday confirmed it notified 464,088 people of a February 2024 data breach that exposed names, Social Security numbers, medical record numbers, treatments, conditions, diagnoses, medications, health insurance info, driver’s licenses, and dates of birth.

Ransomware group ThreeAM claimed responsibility for the breach shortly after it occurred on February 22, 2024. Kootenai Health says it became aware of the breach on March 2, 2024.

Kootenai did not verify ThreeAM’s claim. We do not yet know how attackers breached Kootenai’s network, how much ransom ThreeAM demanded, or whether Kootenai paid the ransom. Comparitech contacted Kootenai Health for comment and will update this article if it responds.

Victims can enroll in 12 free months of credit monitoring and ID theft protection via CyberScan. The deadline to enroll is November 7, 2024. Comparitech recommends victims monitor their credit reports, financial accounts, and medical bills for signs of fraud.

Who is ThreeAM?

ThreeAM, or 3AM, first surfaced in 2023 as an alternative to LockBit, another prominent ransomware strain. ThreeAM rose to prominence when targets began blocking LockBit on their networks.

Its first confirmed attack took place in September 2023. Comparitech researchers tracked just two confirmed ThreeAM attacks in all, plus 28 unconfirmed attacks. The other confirmed attack was on Virginia estate planning firm Carrell Blanton Ferris.

Ransomware attacks on US healthcare

So far in 2024, Comparitech researchers recorded 55 confirmed ransomware attacks on US healthcare organizations including hospitals, clinics, and pharmacies. This attack on Kootenai Health is the fifth largest based on records affected.

The average ransom for all attacks in the healthcare sector is $825,000.

We logged another 101 unconfirmed ransomware attacks on US healthcare so far this year.

About Kootenai Health

Founded in 1956, Kootenai health consists of one hospital in Coeur d’Alene, Idaho and a clinic in Post Falls, Idaho. It employs 3,700 people, according to its website. The main hospital houses 330 beds. Kootenai’s regional system also includes more than 25 clinic specialties in 30 locations across Idaho, Washington, and Montana.