Saint Francis Health System Acknowledges Breach, but Doesn’t Pay Ransom

Despite acknowledging that it had been the victim of a data breach involving ransomware earlier this month, the Tulsa, Okla.-based Saint Francis Health System decided not to act on the ransom demand, according to media reports.

According to a Tulsa World report, Saint Francis Health System was the victim of a data breach earlier this month in which approximately 6,000 names and addresses were compromised. “TheDarkOverlord,” who has previously hacked multiple hospitals and then attempted to extort them for money, claimed the attack on Saint Francis, but according to DataBreaches.net, whether that’s actually true or not remains unclear.

Officials at Saint Francis Health System were notified Sept. 7 that patient data was extracted from a server during an unauthorized external access. An anonymous demand for payment was made to the health provider in return for recovery of the information, according to a news release from Saint Francis. The Tulsa World report stated, “Officials decided not to act on the ransom demand after notifying law enforcement because payment would not guarantee or prevent data from being disclosed, the release states.” The issue of paying the ransom or not has been a hot one in the industry as ransomware breaches continue to plague hospitals and health systems.

Saint Francis said the data breach does not involve electronic health records (EHRs), social security numbers, driver's license information or financial information. The information breached is just related to names and addresses, reported the executive director of communications Lauren Landwerlin, per a report from KJRH-TV, an NBC-affiliated television station located in Tulsa.