Medical device manufacturer PRC-Saltillo notifies 51.6K of data breach following ransomware attack

According to an update on the HHS data breach portal, 51,627 people are confirmed to have been affected in the recent data breach on medical device manufacturer, Prentke Romich Company dba PRC-Saltillo. The company began issuing notifications for its August 2024 data breach in mid-September after ransomware gang Fog claimed an attack on the company. 

PRC-Saltillo noted systems disruptions on August 21 and “determined that between August 13 and August 21, 2024 an unauthorized actor may have copied certain files and folders from PRC-Saltillo’s network without authorization.”

Data affected in the breach includes: names, addresses, phone numbers, dates of birth, treatment cost information, referring/treating physician, health insurance policy numbers, Medicare/Medicaid plan names, and/or medical device purchased. It is offering those affected free access to credit monitoring services through Experian.

In mid-September, ransomware gang Fog posted the company to its data leak site, alleging to have stolen 250GB of data.

PRC-Saltillo hasn’t confirmed Fog’s claims, whether or not a ransom was paid and/or demanded, or how systems were infiltrated. Comparitech has contacted the company for more information and will update this article if it responds.

Who is Fog?

Fog is a relatively new ransomware variant that first emerged in May of this year. Since then, we have tracked four confirmed and 16 unconfirmed attacks via this group.

Confirmed attacks also include Asbury Theological Seminary (US), the City of Cold Lake (Canada) and West Allis-West Milwaukee School District (US).

Odessa College looks set to join this list after it started issuing data breach notifications to 3,521 Texans this week. This follows claims of an attack from Fog in July after network disruptions were noted by the college in June. Fog also claimed an attack on Waupaca School District (unconfirmed).

Ransomware attacks on US healthcare companies

Companies operating within the healthcare sector remain a key target for hackers with 79 attacks noted so far this year. These have affected nearly 7.9 million records in total. We have also logged 154 unconfirmed attacks on this sector this year.

It was recently confirmed that drug wholesale company, Cencora Inc., paid the highest-known ransom of a whopping $75 million in February 2024. Ransomware group Dark Angels originally demanded $150 million from the company.

The attack on United Seating and Mobility, L.L.C., d/b/a Numotion via Black Basta in March 2024 also resulted in a data breach of nearly 700,000 people. 

About PRC-Saltillo

The company was first formed in 1966 as the Prentke Romich Company before it merged with its sister company, Saltillo in 2019. Today, PRC-Saltillo specializes in AAC Solutions, which includes manufacturing devices for individuals with speech disorders.