Breach Announcement
Woodcreek’s information technology vendor, Netgain Technology LLC, experienced a data breach secondary to a ransomware attack. According to Netgain Technology’s investigation, the breach occurred sometime between November 24 and December 3, 2020, although it is possible that access to Netgain’s systems was as early as September 2020.
The server containing Woodcreek’s medical records system was untouched; however, scanned clinical and financial data and other business records on an archive server was stolen by the attackers. The data was returned after the ransom was paid and we have no reason to believe it has been or will be further used or disclosed. On January 18, 2021, Woodcreek received a copy of the recovered data set and has been working diligently since then to notify affected individuals.
The server containing Woodcreek’s medical records system was untouched; however, scanned clinical and financial data and other business records on an archive server was stolen by the attackers. The data was returned after the ransom was paid and we have no reason to believe it has been or will be further used or disclosed. On January 18, 2021, Woodcreek received a copy of the recovered data set and has been working diligently since then to notify affected individuals.
What Information was Exposed?
For employees, contractors, applicants, and providers: Full names, dates of birth, social security numbers, student identification numbers, health insurance policy numbers, bank account numbers (from direct deposit forms and voided checks), resumes, transcripts, performance appraisals, criminal background check reports, court documents related to garnishments, court orders and decrees, copies of diplomas, degrees, board certifications, Drug Enforcement Agency certificates, payroll withholding authorizations for 401k elections and insurance deduction authorizations, benefit enrollment forms, payroll tax forms (W2s, W4s, 1095s, & K1s), and employee health information, including vaccination records, on-the-job injury reports and safety incident reports.
For parents/guardians who insure patients of Woodcreek Healthcare or MultiCare Health System: Full subscriber names and insurance policy numbers.
For Woodcreek Healthcare or Woodcreek Pediatrics - Mary Bridge Children's patients: Full subscriber names and insurance policy numb ers; there is also a small possibility that date of birth, medical record number, and clinical information could be included in the breach as well.
For parents/guardians who insure patients of Woodcreek Healthcare or MultiCare Health System: Full subscriber names and insurance policy numbers.
For Woodcreek Healthcare or Woodcreek Pediatrics - Mary Bridge Children's patients: Full subscriber names and insurance policy numb ers; there is also a small possibility that date of birth, medical record number, and clinical information could be included in the breach as well.
Did you receive a letter addressed to someone else?
People who were affected by this breach include anyone seen by Woodcreek Healthcare or Woodcreek Pediatrics - Mary Bridge Children's from January 1, 2005 to November 30, 2020; a few specific letters go back as far as 1997. As you might imagine, our address information for someone seen over 15 years ago has a good chance of being wrong; nevertheless, federal law obligates us to attempt to deliver a notice. You might receive a letter addressed to someone who used to live at your address; like all misdirected email, we ask that you write "return to sender" on the envelope and pop it back in the mail.
Where can I get more information?
Woodcreek is maintaining a call center and website for this breach. The call center can be reached at (833) 726-0944. The website URL is https://response.idx.us/woodcreek.