113,000 Impacted by Data Breach at Virginia Mental Health Authority

Richmond Behavioral Health Authority (RBHA), the Virginia mental health services provider serving the city of Richmond, says personal information for more than 113,000 people was stolen in a recent ransomware attack. On 29 September the attack hit RBHA’s network, with portions of it encrypted, and RBHA identified the incident on 30 September and evicted the attackers.

The threat actor potentially accessed names, Social Security numbers, passport numbers, and financial account and health information, though there is no definitive evidence that personal information was accessed at this time. According to the US Department of Health and Human Services, RBHA told the agency that 113,232 individuals were affected by the incident, and the organisation notes that the Qilin group claimed the attack in mid-October, subsequently publishing data from RBHA. RBHA did not name the ransomware gang in its notice, but the group’s leak site lists the healthcare organisation among its targets.