Getting your Trinity Audio player ready...

ST. JOSEPH – On July 16, Spectrum Health Lakeland was made aware of a global data security incident involving Blackbaud, Inc., which hosts data for the Spectrum Health Lakeland Foundation. The health system learned that Blackbaud had been the victim of a ransomware attack that was discovered and ended in May of this year. This security incident impacted Blackbaud’s clients across the U.S. and around the world including thousands of other non-profit organizations.

Criminals use ransomware to get companies to pay money to regain access to their electronic information. The cybercriminals were able to remove a copy of a subset of data that included some information from the Spectrum Health Lakeland Foundation. Importantly, no Spectrum Health technology, computer networks, or systems were impacted by this incident.

This data incident did not involve passwords, credit card or bank information. In fact, such financial-related data is not kept in the Spectrum Health Lakeland databases hosted by Blackbaud, officials said. The health system conducted its own independent investigation and learned the data accessed by the cybercriminals included some protected health information of Spectrum Health Lakeland patients.

The patient information was limited and may have included name, address, date of birth, email, medical record number, history of donating to the Spectrum Health Lakeland Foundation (if applicable), and other publicly available information. Although it was not widespread, there were a few cases in which social security numbers were impacted. Spectrum Health Lakeland will be contacting patients by mail if their information was included in the Blackbaud incident.

“We know this incident is disappointing to our friends and neighbors as they place their trust in us and we work diligently every day to keep that trust,” said Loren B. Hamel, MD, president, Spectrum Health Lakeland. “Given the nature of cyberattacks today, we continuously work with all our vendors to help ensure that when they are performing services for Spectrum Health Lakeland, they are also keeping patients’ information safe and secure.”

To protect individuals’ data and avoid potential identity theft, Blackbaud paid the cybercriminals ransomware demand. According to Blackbaud, they were assured the data file was destroyed. Blackbaud has been working with third-party experts to monitor the web to verify the data accessed by the cybercriminals was destroyed and has not been misused. An incident summary is posted on the Blackbaud website.

In a statement on its website, Blackbaud said in part, “We apologize that this happened and will continue to do our very best to supply help and support as we and our customers jointly navigate this cybercrime incident.”

Spectrum Health Lakeland encourages patients with questions to call 888.952.9101 or email privacy@spectrumhealth.org.