OnePoint Patient Care data breach impacted 795916 individuals

US hospice pharmacy OnePoint Patient Care suffered a data breach that exposed the personal info of approximately 800,000 individuals.

OnePoint Patient Care is a U.S.-based pharmacy specializing in hospice and palliative care services, providing customized medications and support for patients with advanced illnesses. It partners with healthcare providers to manage and deliver complex medication regimens directly to patients’ homes or care facilities.

The company suffered a data breach that exposed the personal info of approximately 800,000 individuals. OPPC reported to the US Department of Health and Human Services that the security incident impacted 795916 individuals. 

The organization observed suspicious activity on its network on August 8, 2024 and promptly initiated an internal investigation. The company started its incident response procedure to contain the incident with the help of a forensic security firm.

“On August 8, 2024, OPPC detected suspicious activity on its computer network. Upon identifying the issue, OPPC promptly initiated an internal investigation, took steps to contain the incident, and engaged a forensic security firm to further investigate. OPPC also notified law enforcement.” reads the notice of Data Security Incident published by the company on its website. “The incident had no impact on OPPC’s operations but, on August 15, 2024, OPPC learned that, between August 6 and 8, 2024, someone obtained some individuals’ personal information from OPPC’s systems without authorization.”

OnePoint Patient Care (OPPC) discovered the data breach on August 15, 2024, an unauthorized party has access to personal information between August 6 and 8, 2024.

The compromised data includes names, residence information, medical records, diagnosis, prescription details, and, for some, Social Security numbers.

OPPC recommends that impacted individuals monitor credit reports and statements for suspicious activity and report any fraud to law enforcement.

In September, the Inc Ransom ransomware group added healthcare organizations to the list of victims on its Tor leak site. The company did not pay the ransom and Inc Ransom group leaked data allegedly stolen from the organization.

The INC RANSOM has been active since 2023, it claimed responsibility for the breach of at least 65 organizations to date.

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, OnePoint Patient Care)