Dr. Kristin Tarbert Plastic Surgery Offices Data Breach (2020)

Despite having proclaimed that they would not be attacking medical entities during the pandemic, Maze Team has attacked another medical entity: a Bellevue, Washington-based plastic surgeon who specializes in surgery of the eye and facial areas. Dr. Kristin Tarbet’s website does not provide any notice or indication of trouble, but Maze claims to have successfully attacked them on May 1, and offers plenty of proof of attack. As part of its proof, Maze dumped a number of files with protected health information. One spread sheet for patient appointments contained approximately 39000 entries. A small number of entries were test data, but the rest appeared to be real data, where there might be multiple entries/rows for any one patient. For each patient, there was a first name and last name, date of birth, date of appointment, type of appointment, purpose of appointment, length of appointment, and any comment. Patient addresses, phone numbers, and insurance information were not included in this particular spreadsheet, but were included in other spreadsheets that also contained patients’ email addresses, home and mobile numbers, and for some patients, Social Security numbers. Yet other files contained specific medical information such as diagnostic codes, treatment codes, complaints, allergies, and medications that the patient was on, height, weight, blood pressure, respiration rate, and other notes. And yet another file contained insurance information.