HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) Primary notice
Posted on the HHS OCR breach portal (HIPAA breaches affecting 500 or more individuals) with a submission date of Aug. 21, 2015.
- Organization as reported
- Pediatric Group LLC, IL
- Entity type as reported
- Healthcare Provider
- Category as reported
Hacking/IT Incident
- Location of information as reported
- Network Server
- Submission date
- Aug. 21, 2015
- Observed by BreachRecords
- 2026-10-18 16:15 UTC (revision 14728, row:5867)
- Archived copy
- Held in the private archive (provenance)
On August 21, 2015, an unknown entity hacked into the covered entity's (CE) electronic database utilizing a Crypto Locker computer virus, and the virus attached to some of the CE's Portable Document Format (PDF) files which contained patients’ names, dates of birth, clinical information, and other personal identifiers. The virus then blocked the CE's access to the aforementioned PDF files and the CE received an email message demanding a $500.00 ransom in order to gain access to the locked PDF files. Approximately 10,000 individuals were affected by the breach. Upon discovering the breach, the CE conducted a breach risk assessment which indicated that there was a low overall probability that protected health information (PHI) was compromised, and therefore, breach notification to individuals and the media was not required. The CE reported the breach incident to the Internet Crime Complaint Center, a division of the Federal Bureau of Investigations. To prevent similar breaches from happening in the future, the CE retained a computer forensic firm to assist with the analysis of the ransomware incident, and installed anti-malware products on all its computers. The CE trained staff on its policies and procedures regarding Cyber Security Awareness. OCR obtained documented assurances that the CE implemented the corrective actions noted above.