Tri-City Medical Center increases ransomware data breach figure to over 108K

California’s Tri-City Medical Center has upped the number of people involved in its November 2023 ransomware attack to 108,149. In its previous notification (dated March 2024), it alerted just 7,847 people that this attack may have impacted their names and Social Security numbers.

The attack also caused widespread disruption, shutting down the majority of the hospital’s emergency services and forcing the hospital to declare a state of emergency. It took nearly eight days for it to restore its systems.

In December 2023, ransomware group INC claimed the attack. The proof pack uploaded by INC appeared to show financial records from Tri-City as well as surgical authorization forms and patients’ medical records.

Tri-City hasn’t confirmed INC’s claims and whether or not a ransom was demanded. Comparitech has contacted the medical center for more information and will update this article if it responds. In the meantime, it is offering those affected complimentary credit monitoring and identity theft protection services through IDX for a year.

Who is INC?

INC first appeared in July 2023 and targets a wide range of victims in healthcare, education, and government. Its methods involve spear phishing and exploiting known vulnerabilities in software. It has been confirmed as the ransomware group across 47 attacks and has claimed a further 126 unconfirmed victims. According to our data, over 1.4 million records were affected across the confirmed attacks.

Other recently confirmed attacks on healthcare companies via INC include McLaren Health Care and Access Sports Medicine & Orthopaedics. The former caused widespread disruption across a number of hospitals while the latter affected over 88K records.

Ransomware attacks on US healthcare

In 2023, we tracked 140 ransomware attacks on US healthcare companies, affecting nearly 23.8 million records. So far this year, we’ve tracked 70 affecting 7.3 million records. The average ransom across these 2023/24 attacks is over $1 million.

Over the last week or so, attacks have been confirmed on Southwest Colorado Mental Health Center, Inc. d/b/a Axis Health System and Omni Family Health.

We have also tracked 130 unconfirmed attacks on US healthcare companies this year so far. INC has claimed 19 of these attacks.

About Tri-City Medical Center

Located in Oceanside near San Diego, California, Tri-City Medical Center was opened in 1961. It is a full-service, acute-care public hospital with nearly 400 beds and over 700 physicians who specialize in more than 60 areas.