Cherry Health Data Breach Caused by Ransomware

Cherry Health, a Michigan-based healthcare provider, revealed that a ransomware attack was responsible for a previously disclosed data breach. The breach compromised the personal and financial information of 184,372 victims, mostly from Michigan.

The incident itself took place on December 21, 2023, and was first detected on Christmas Eve. The organization came out with a statement to announce the incident in early January.

In February, Cherry provided an update alerting customers that their data had been compromised. They also claimed that “We are not aware of any evidence that any information has been misused as a result of this cybersecurity incident” and that they have “partnered with third-party specialists” to conduct a full-scale investigation.

Cherry first became aware of the breach after a network disruption affected their ability to “access certain systems.” The ensuing investigation revealed that some of its data was improperly accessed. By March 2024, the investigation had determined what data was stolen and to whom it belonged.

According to Cherry, the data stolen includes:

• Names
• Addresses
• Credit card details
• Phone numbers
• Dates of birth
• Health insurance information
• Health insurance ID number
• Patient ID number
• Social Security numbers (in limited cases)

Cherry Health has extended free credit monitoring services and identity protection services to those affected. This includes dark web monitoring by Cyberscan, $1,000,000 in identity theft insurance, and fully managed identity recovery from IDX.

It’s only this week that Cherry Health made a regulatory filing with the Maine Attorney General revealing that the cause of the breach was ransomware.

Based in Grand Rapids, Michigan, Cherry Health operates across six Michigan counties, encompassing 20+ locations and 800+ employees. It describes itself as Michigan’s largest Federally Qualified Health Center (FQHC).

The attack on Cherry Health is nothing new — sensitive healthcare information is regularly targeted by cybercriminals. Last year, a data breach at a Boston consulting firm caused the exposure of over 300,000 Medicare records. Change Healthcare was also forced to pay a ransomware gang $22 million to avoid the release of 4TB of data.