ROCHESTER, N.Y. \u2014 Rochester Regional Health patients received letters about a data breach, but the letters themselves looked like scams. The letters were sent by a third-party vendor and incorrectly identified the hospital system as \u201cRochester Regional Medical Center,\u201d which doesn\u2019t exist. Hospital officials confirmed to News10NBC the letters are legitimate despite the error. <\/p>\n
According to the letter from Xsolis sent to patients, there was unauthorized activity in a system Rochester Regional previously used after a phishing attack in January. The breach may have exposed personal and protected health information. Many people who received the letter thought it was a scam and threw it out.<\/p>\n
On Facebook, several people replied to News10NBC\u2019s post saying they all got the letter and were suspicious. <\/p>\n
Sandie Yocum said her wife received the letter and was cautious from the start. \u201cMy wife gets so worried about being a victim of identity theft and stuff, so she had me immediately investigate it, because the envelope was even off,\u201d Yocum said. \u201cWe were like, this isn\u2019t a Rochester Regional envelope, and I\u2019ve never heard of Rochester Medical Center.\u201d <\/p>\n
This isn\u2019t the first time Rochester Regional Health has had a data breach. News10NBC found two previous incidents \u2014 one in 2020 and another in 2023.<\/p>\n
RELATED: Consumer Alert: A huge data breach is affecting patients across the Rochester area \u2013 here\u2019s what you need to do \u2013 WHEC.com<\/a><\/p>\n In December, Rochester Regional Health received $15 million in state funding to upgrade its cybersecurity infrastructure in an effort to protect hospitals from cyber threats. <\/p>\n RELATED: Rochester Regional Health secures $15M for cybersecurity upgrades \u2013 WHEC.com<\/a><\/p>\n Jonathan Weissman, a cybersecurity professor at Rochester Institute of Technology, explained what criminals can do with stolen healthcare information. <\/p>\n \u201cCriminals can get medical services and even prescriptions using the stolen information,\u201d Weissman said. \u201cThis illustrates the importance of verifying unexpected communications through official channels,\u201d Weissman said. <\/p>\n Healthcare systems can contain large amounts of personal and medical information. These pieces of information can be used for scams, fraud and identity theft. <\/p>\n Weissman said children\u2019s information is especially sensitive because misuse may not be detected for years. The letter offers free 12-month identity monitoring to help protect children\u2019s identities. <\/p>\n \u201cThis illustrates the importance of verifying unexpected communications through official channels,\u201d Weissman said. <\/p>\n According to Xsolis, the unauthorized activity has been contained and there is no evidence the data has been misused. Impacted patients should follow the instructions in the notification to receive no-cost identity monitoring. <\/p>\n Weissman said patients who received the letter should carefully read the notification, enroll in the free monitoring services and monitor their accounts for any unusual activity. <\/p>\n \u201cBe on the lookout for emails, texts or phone calls claiming to be from the healthcare provider, insurer or the monitoring service,\u201d Weissman said. \u201cIncidents like this can be followed up by targeted phishing attempts and impersonation scam attempts.\u201d Weissman also recommended freezing credit as one of the most effective ways to prevent new account fraud. \u201cAt this point, there is no indication that there has been fraudulent use of the exposed data, but still take the recommended steps,\u201d Weissman said. Rochester Regional Health said protecting patient information is a responsibility it takes seriously. <\/p>\n The hospital system said it expects partners to meet strict security and privacy standards and remains committed to safeguarding information entrusted to it.<\/p>\n Rochester Regional Health\u2019s full statement is below. <\/p>\n Media Statement<\/p>\n We are aware of a data security incident involving Xsolis, Inc., a third-party vendor that previously provided services to Rochester Regional Health.<\/p>\n Rochester Regional Health\u2019s relationship with Xsolis ended in 2021, well before this incident occurred. While we no longer work with this vendor, we have been notified that information related to some current or former patients may have been involved. This impacts approximately 18,600 patients associated with our system, representing a small portion of the more than 500,000 patients we serve each year.<\/p>\n Rochester Regional Health was incorrectly identified as \u201cRochester Regional Medical Center\u201d in the notification. We have raised this issue with the vendor and requested that it be corrected.<\/p>\n According to Xsolis, the incident was the result of unauthorized access within its environment earlier this year. The vendor has indicated that the activity has been contained and that there is no evidence of misuse of the data at this time. Impacted patients should follow the instructions contained in the notification to receive no-cost identity monitoring.<\/p>\n Protecting patient information is a responsibility we take seriously. We expect our partners to meet strict security and privacy standards, and we continue to reinforce those expectations across all relationships. We remain committed to safeguarding the information entrusted to us and to maintaining the trust of our patients and community.<\/p>\n \t\t\t\t\t\t\t\tFor Related Stories:\u00a0data breach<\/a>\u00a0\u00a0rochester regional health<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"ROCHESTER, N.Y. \u2014 Rochester Regional Health patients received letters about a data breach, but the letters themselves looked…\n","protected":false},"author":2,"featured_media":480202,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[34],"tags":[6904,134,527,111,139,69,241542],"class_list":["post-480201","post","type-post","status-publish","format-standard","has-post-thumbnail","category-healthcare","tag-data-breach","tag-health","tag-healthcare","tag-new-zealand","tag-newzealand","tag-nz","tag-rochester-regional-health"],"_links":{"self":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/480201","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/comments?post=480201"}],"version-history":[{"count":0,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/posts\/480201\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media\/480202"}],"wp:attachment":[{"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/media?parent=480201"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/categories?post=480201"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.newsbeep.com\/nz\/wp-json\/wp\/v2\/tags?post=480201"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}