St. Louis-based Ascension said hackers stole files that likely contained patient data during the recent cyberattack on the health system.
The cybercriminals took the files after accessing seven of the 140-hospital system's roughly 25,000 servers, according to a June 12 statement. Those servers are used by employees primarily for "daily and routine tasks," and the health system has no evidence that data was stolen from its EHR or other clinical systems amid the May 8 ransomware attack.
The breached files may have contained patients' protected health and personally identifiable information, according to Ascension. The health system is providing free credit monitoring and identity theft services to any patient or employee who requests it.
"Right now, we don't know precisely what data was potentially affected and for which patients. In order to reach those conclusions, we need to conduct a full review of the files that may have been impacted and carefully analyze them," an Ascension spokesperson told Becker's in an emailed statement. "While we have started this process, it is a significant undertaking that will take time."
Ascension also determined that hackers broke into its network after an employee accidentally downloaded a malicious file that the person thought was legitimate. "We have no reason to believe this was anything but an honest mistake," the spokesperson said.