ATI Holdings, LLC and its Subsidiaries Updates Notice to Individuals of a Data Security Event
ATI Holdings, LLC and its Subsidiaries Updates Notice to Individuals of a Data Security Event
Bolingbrook, IL - [April 13, 2018] - On behalf of itself and its affected partners, ATI Holdings, LLC and its subsidiaries ("ATI") is announcing an update to its continuing investigation into recent phishing attempts directed at ATI employees.
As previously disclosed, some employees of ATI Holdings, LLC and its subsidiaries ("ATI") were victims of an email phishing attack and, after a thorough digital forensic examination, investigators discovered that some patient information may have been accessible through some of the impacted employees' email accounts. More recently, ATI identified that a limited number of patients of certain ATI partners, including approximately 1700 patients of Hinsdale Orthopaedic Associates, S.C. ("HOA"), were also affected by the incident.
The phishing attack, which targeted access to employees' personal direct deposit information, started on or about January 9, 2018 and was discovered by ATI on January 11, 2018. ATI took immediate action to lock down the impacted employees' accounts, investigate the incident, and confirm that no other ATI systems were affected.
A forensic investigation confirmed that no other ATI systems were impacted. ATI ensured that all employees identified as impacted have changed their passwords. ATI is taking additional actions to strengthen the security of its email systems moving forward, as well as providing additional training to users and employees on how to identify phishing scams. ATI has also contacted and is working with appropriate law enforcement agencies and regulators regarding this incident.
After an exhaustive search of the impacted email accounts, ATI determined that certain types of HOA patient information were included within one or more of these email accounts. On or around March 14, 2018, ATI determined that one or more of the affected email accounts contained, and the unauthorized actor may have had access to, the following information related to HOA patients: name, date of birth, driver's license or state identification number, Social Security number, credit card number, financial account number, patient identification number, Medicare or Medicaid identification number, medical record number, diagnosis, disability code, treatment information, medication/prescription information, doctor's or therapist's name, billing/claims information, and/or other health insurance information. The type of information potentially affected was not the same for each individual. Social Security number was only impacted for a small percentage of the affected population. ATI provided notice to HOA on March 29, 2018, and HOA and ATI moved quickly to notify affected patients.
While ATI's investigation to date has found no evidence of actual or attempted misuse of patient information, beginning on April 13, 2018, ATI is sending notice to potentially affected HOA patients about the incident and offering identity theft and credit monitoring services.
ATI encourages potentially impacted individuals to remain vigilant against incidents of identity theft and fraud, to review account statements, and to monitor their credit reports and explanation of benefits forms for suspicious activity. ATI is providing potentially impacted individuals with contact information for the three major credit reporting agencies, as well as providing advice on how to obtain free credit reports and how to place fraud alerts and security freezes on their credit files.
ATI has set up a call center to answer questions from those who might be impacted by this incident. Anyone with additional questions about the incident may contact the call center at 1-855-828-5850 (toll free), Monday through Saturday, 8:00 a.m. to 8:00 p.m. CT. If you do not receive a letter in the coming weeks, but want to know whether you are affected, please contact the call center at 1-855-828-5850. Additional information can also be found at ATI's website, https://www.atipt.com/.
ATI values its patients' privacy and security and deeply regrets any concern or inconvenience this situation may cause.
/PRNewswire/ -- April 13, 2018/
SOURCE ATI Holdings, LLC
