HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS Office for Civil Rights breach portal with a submission date of Nov. 13, 2015.
- Organization as reported
- OH Muhlenberg, LLC, KY
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Desktop Computer, Email, Laptop, Network Server, Other Portable Electronic Device
- Submission date
- Nov. 13, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14671, row:5810)
- Archived copy
- Held in the private archive (provenance)
The FBI notified the covered entity (CE), OH Muhlenberg, LLC, on September 16, 2015, that its information system had been infected with malware known as “QuakBot.” Based on the CE’s internal investigation, it determined that the malware may have been present on its system as early as January 1, 2012 and may have affected its entire patient database of 84,506 patients. The types of protected health information (PHI) involved included names, dates of birth, addresses, phone numbers, driver’s licenses/state identification information, social security numbers, credit card/bank account numbers, health insurance information, and clinical information. In response to the breach, the CE decommissioned affected computers, replaced older computer hardware, implemented revised policies and procedures, improved antivirus protection and provided security awareness training to its workforce. The CE provided breach notification to HHS, to affected individuals, to the media and on its website. OCR obtained assurances that the CE implemented the corrective actions listed above