Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

Medical IT Contractor Folds After Breaches

Blamed for privacy breaches at five different hospitals, Verus Inc. silently closes its doors

Verus Inc., the IT contractor that has been implicated in security breaches at at least five different hospitals across the country, has gone out of business.

The Bellevue, Wash., company, which built and maintained Websites and services on behalf of some 40 to 60 hospitals nationwide, was disbanded "eight to 10 weeks ago" when investors pulled the plug following a massive blunder that exposed many of its clients' data to the outside world, according to an executive at MedSeek, an IT contractor that is now handling many of Verus' clients.

While reports of the breaches have been issued in dribs and drabs, all of the data losses can now be attributed to a single incident, in which Verus employees left a firewall down following the transfer of data from one server to another, according to David Levin, vice president of marketing at MedSeek.

"All of the breaches were the result of an IT error, as opposed to any problems with the software," Levin says. "They made a huge mistake, and it literally shut the company down. It's really a cautionary tale."

Verus's Website has been pulled down, and calls to the company's offices are referred to MedSeek customer service. No announcement of the shutdown, nor any explanation of the reasons behind it, appear to have been issued to the media or to Verus partners.

"We're not sure if the breaches were the only reason why they closed down -- there might have been other issues as well," Levin says. "But we know we got the call to support the [Verus] customers very soon after the breach was supposed to have happened."

Reports of the breaches range from mid-April to late May, but Verus has been implicated in at least five disclosures since the beginning of June:

  • On June 4, Stevens Hospital in Edmonds, Wash., reported the exposure of 550 patients' data through a failure in the online bill payment service operated by Verus.

  • On June 6, Keenewick General Hospital in Washington reported a similar breach affecting 1,000 patients, and attributed it to the Verus online bill payment service.

  • On June 7, Concord Hospital in New Hampshire disclosed the loss of 9,000 names because Verus had "turned off a firewall for maintenance purposes" and failed to turn it back on again. The breach was not disclosed publicly until late July (See Third Parties Fumble Data Handoffs.)

  • On July 24, St. Vincent's Hospital in Indiana reported a security breach that exposed data on some 51,000 patients. The hospital blamed Verus, which exposed the data while transferring data between servers.

  • Earlier today, Sky Lakes Medical Center in Oregon revealed that 30,000 patients' names had been inadvertently exposed in late May, when Verus didn't take sufficient precautions while transferring data from one server to another.

All of the hospitals said they immediately terminated their contracts with Verus following the breach. All of the hospitals said they have yet to see any reports of hackers or criminals using the data.

According to Levin, the breaches all affected hospitals using Verus's VPAC online billing system, which MedSeek does not use. Verus's hospital customers will be given a choice as to whether they want to migrate to the MedSeek platform and services, or move to some other vendor.

Have a comment on this story? Please click "Discuss" at the top of this page. If you'd like to contact Dark Reading's editors directly, send us a message.

Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
News
FluBot Malware's Rapid Spread May Soon Hit US Phones
Kelly Sheridan, Staff Editor, Dark Reading,  4/28/2021
Slideshows
7 Modern-Day Cybersecurity Realities
Steve Zurier, Contributing Writer,  4/30/2021
Commentary
How to Secure Employees' Home Wi-Fi Networks
Bert Kashyap, CEO and Co-Founder at SecureW2,  4/28/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
2021 Top Enterprise IT Trends
We've identified the key trends that are poised to impact the IT landscape in 2021. Find out why they're important and how they will affect you today!
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-24259
PUBLISHED: 2021-05-05
The “Elementor Addon Elements� WordPress Plugin before 1.11.2 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVE-2021-24260
PUBLISHED: 2021-05-05
The “Livemesh Addons for Elementor� WordPress Plugin before 6.8 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by lower-privileged users such as contributors, all via a similar method.
CVE-2021-24261
PUBLISHED: 2021-05-05
The “HT Mega – Absolute Addons for Elementor Page Builder� WordPress Plugin before 1.5.7 has several widgets that are vulnerable to stored Cross-Site Scripting (XSS) by ...
CVE-2021-24262
PUBLISHED: 2021-05-05
The “WooLentor – WooCommerce Elementor Addons + Builder� WordPress Plugin before 1.8.6 has a widget that is vulnerable to stored Cross-Site Scripting (XSS) by lower-priv...
CVE-2021-24263
PUBLISHED: 2021-05-05
The “Elementor Addons – PowerPack Addons for Elementor� WordPress Plugin before 2.3.2 for WordPress has several widgets that are vulnerable to stored Cross-Site Scriptin...