Law Firm Cyberattack Exposes Tens of Thousands of Patient Records

A law firm cyberattack potentially exposed the personal health information of more than 36,000 University of Pittsburgh Medical Center (UPMC) patients.

That’s according to a Text IQ analysis of the attack on Charles J. Hilton & Associates.

The law firm provides legal services to UPMC. According to Infosecurity, the firm discovered suspicious activity in its employee email system last June. An investigation determined hackers gained access to several employee email accounts between April 1 and June 25.

Cybercriminals prefer to target entities like law firms since they have enterprise data. In addition, law firms, unlike enterprises, may not spend tens of millions of dollars each year on cybersecurity.

We spoke with Apoorv Agarwal, Text IQ‘s co-founder and CEO, to find out more about the law firm cyberattack.

Channel Futures: How did cybercriminals carry out the law firm cyberattack? Why was this cyberattack successful?

Text IQ’s Apporv Agarwal

Apoorv Agarwal: Generally, digital forensics handles the cyber investigation of a data breach, and should identify the cause and scope of the attack. In this case, the specific details have not yet been released. But during the COVID-19 pandemic, we have seen a staggering 109% year-over-year increase in U.S. ransomware attacks in the first half of 2020. With employees working from home, away from the safety of office firewalls and strict protocols, companies have scrambled to bolster their cyber defenses and perpetrators have run rampant.

CF: What will be the likely impact of this law firm cyberattack?

AA: The sensitive information that was compromised included several employees and possibly patients who likely reside in different states and possibly countries. The current regulatory landscape includes a patchwork of data privacy and data breach laws. That means the notification obligations and corresponding penalties vary widely. For example, much of the exposed health care data is regulated by HIPAA, while the personal information that was exposed is covered by state-level data breach laws. Without understanding whose data has been breached, impacted entities are compelled to issue blanket notifications for all the people potentially impacted. This means the law firm will have to provide notifications to all the states in which the patients reside, as well as the U.S Department of Health and Human Services, even if the amount of data and information types do not meet the reporting threshold for some states.

CF: Are we seeing an increase in law firms targeted by cybercriminals? If so, why?

AA: According to the American Bar Association and the U.S. Department of Justice, 25% of all law firms have been subjected to or experienced some form of a data breach involving hackers. Law firms are a vulnerable target for cybercriminals for three reasons. First, they tend to have access to highly sensitive data. Generally, the kind of information you exchange with a law firm has a higher degree of sensitivity than that exchanged with other partners. Second, a law firm has access to data from several enterprise clients, which for a cybercriminal can mean more reward for a similar level of effort. Third, they invest much less in cybersecurity compared to enterprises. 

Deloitte estimates large enterprises such as major financial institutions spend on average about $2,300 per employee on cybersecurity. Microsoft alone will spend $1 billion annually for cybersecurity.

CF: What aren’t law firms doing that they should be doing to fend off these attacks?

AA: There are three things law firms should be doing to fend off these attacks. First, investing in their own cybersecurity capabilities, including processes, technologies and training for lawyers within the firm to boost awareness of the risks to sensitive information. Second, investing in technologies, including [machine learning], which operate in highly secure remote cloud environments and reduce the number of humans that are needed to review sensitive data. Each body that has access to sensitive information adds a degree of risk. An additional security precaution to limit access to sensitive data is to redact personal or health information in reports or other documents.

Finally, there are a number of vendors with highly secure data centers or cloud deployments which law firms can work with to …