Allegheny Health Network (AHN) has confirmed a significant data loss event, impacting nearly 300,000 individuals. The incident, which led to the unauthorized disclosure of personal information, originated from a critical vulnerability identified in the widely-used MOVEit Transfer file transfer application.

The security incident was not a direct breach of AHN’s internal systems but rather occurred through third-party vendors that utilize the MOVEit Transfer software. These vendors, which process data on behalf of AHN, were affected by the vulnerability. Specifically, PBI Research Services and Blackbaud, both vendors engaged by AHN, were impacted by the MOVEit vulnerability, leading to the compromise of AHN-related data they held.

Scope of the Allegheny Health Network Data Loss

The data loss has wide-reaching implications, affecting a total of 298,908 individuals. The types of personal information compromised vary depending on the individual’s relationship with AHN:

• For AHN Patients: The unauthorized disclosure included patient names, dates of birth, Social Security numbers, health insurance information, medical record numbers, and protected health information (PHI) such as details related to diagnoses and treatments.
• For AHN Employees and Retirees: Compromised data included names, dates of birth, Social Security numbers, and health insurance information.

Upon learning of the incident and the potential exposure of sensitive data, Allegheny Health Network took prompt action. AHN has confirmed that it directly notified all affected individuals about the data loss. To mitigate potential risks to those impacted, the organization is offering complimentary credit monitoring and identity theft protection services. These services aim to provide a layer of security for individuals whose Social Security numbers and other personal information may have been exposed.

Responding to Third-Party Supply Chain Risks

This incident underscores the complex challenges organizations face in managing cybersecurity risks, especially those introduced through third-party vendor relationships. While AHN’s own systems were not directly breached, the reliance on external software and service providers means that vulnerabilities in their tools can still lead to significant data loss for the primary organization and its constituents. Organizations like AHN must continuously assess and reinforce security protocols, not only within their own infrastructure but also across their entire supply chain of partners and vendors.