-
Interlock claims it stole the Social Security numbers of over 150,000 patients from an Oklahoma City orthopedic practice.
-
The group says it possesses the practice’s medical information list and payment records.
-
The medical practice has not yet verified the hacking incident, but patients should remain vigilant for any signs of fraud.
An orthopedic surgery practice with clinics across the Oklahoma City area faces a serious cyber threat. A ransomware group known as Interlock says it stole sensitive patient data from Southwest Orthopedic & Reconstructive Specialists.
The group posted the practice on its dark web leak site. According to its allegations, the stolen information contains certain sensitive details, such as over 150,000 Social Security numbers, medical records, and billing records.
The Claim and What It Contains
Interlock says it leaked the data because the practice refused to resolve the incident. The group links the Social Security numbers to patient names and addresses. It also claims to hold medical records and billing information. No one has verified samples of the data. The practice has not publicly confirmed any incident. Independent researchers have not checked the claims of the group either.
This means patients should treat the claim as unverified for now. It is a threat-actor claim, not proof of a breach. The public should not assume a possible exposure of their data based on this post alone.
The practice has dealt with a separate security matter before. In 2024, it sent patients a notice about a third-party incident involving INTEGRIS Health. That matter has no connection to this new claim. The two events involve different systems and different parties.
Why this Matters for Patients
If the allegations are correct, the compromised information presents enormous risks. When Social Security numbers are available along with names, addresses, and medical history, criminals benefit from them as a strong set of weapons. They might use this information to commit identity theft or medical fraud.
Medical identity theft is a serious hazard. A criminal may use the insurance information of a patient to get medical assistance or obtain medicine. The false records thus become part of the original medical history of the patient. This can influence the medical judgments of the victims made in the future, plus their claims with insurance companies.
Patients should be on the lookout for bills from providers whom they did not visit. They should check their insurance statements as well when checking the services they did not avail themselves of. Credit freeze and a fraud alert will ensure safety. People can request a free credit report from each major bureau.
Phishing is also another risk. Criminals may use the stolen information & send plausible emails or messages asking for passwords and payments. This means that the patients should treat unexpected messages related to health as suspicious information.
Legal Duties the Practice May Face
There may be a legal obligation for this practice in case the breach is genuine. According to federal law, healthcare organizations that are covered by HIPAA need to inform affected patients about a breach within 60 days after detection. The provider should also notify the Department of Health and Human Services regarding big data breaches.
Oklahoma state law adds another layer. The Security Breach Notification Act of the state requires entities to notify residents when personal information is exposed. The law covers Social Security numbers in combination with names.
The practice should report this to the Attorney General of Oklahoma without unnecessary delay. State law sets the reporting time limits. If the practice fails to follow the guidelines, the authorities can impose a fine and other penalties on it.
These duties only apply once a breach is confirmed. At this stage, the practice has said nothing publicly. It may still be investigating the group’s claims.
The Pattern of Attacks of Interlock
Interlock is not new to targeting health care. The group pairs data encryption with data theft. It has repeatedly hit US healthcare providers in recent months. Ransomware groups have also exploited weaknesses in network security products, including a case in which attackers used a Cisco firewall flaw for weeks before Amazon reported the activity.
Security researchers have tracked multiple Interlock listings in the past two months. Recent claimed victims include a dental group and an eye center. These listings suggest a pattern of attacks on medical practices.
Stolen data can remain in circulation in the underground marketplace for a long time. Healthcare providers are among the most sought-after targets because their records are highly valuable.
