Enzo Biochem, a biotechnology company based in New York, has revealed that a ransomware attack resulted in the exposure of clinical test data belonging to approximately 2.5 million patients. The company, known for manufacturing and selling DNA-based tests for detecting viral and bacterial diseases like COVID-19 and cancer, confirmed the attack in a recent SEC filing. Enzo managed to keep its operations running by disconnecting its systems from the internet. However, on April 11, it discovered that hackers had gained unauthorized access to and extracted sensitive data from its systems.
The compromised information includes clinical test data of 2,470,000 individuals and around 600,000 Social Security numbers. Enzo is also investigating whether its employees' information was accessed. Enzo CEO Hamid Erfanian acknowledged the risks and uncertainties resulting from the incident, including regulatory scrutiny and potential impacts on the company. Enzo has not disclosed the specifics of how the attack occurred or whether a ransom demand was made. The responsible hacking group has not been identified or claimed responsibility at this time.
This breach adds Enzo Biochem to the growing list of medical companies experiencing data breaches in recent months. In May, PharMerica, a major US pharmacy service provider, reported a breach in which personal data of 5.8 million individuals was stolen, including Social Security numbers and medication and health insurance details. Managed Care of North America Dental, a large dental health insurer, also confirmed a recent ransomware attack resulting in the compromise of personal information belonging to nearly nine million individuals.
Sean McNee, vice president of research and data at DomainTools, shared insights on the impact a ransomware attack can have on biotech companies:
“Biotechnology companies, such as Enzo, are a critical component of the fight against cancer and other viral and bacterial diseases. A ransomware attack of this nature can and should be viewed as an attack on the healthcare supply chain, affecting not just this company or the hospitals and clinics it serves, but all of us who rely on these tests as part of our healthcare. Because this data is extremely sensitive, including people’s health information and SSNs, affected individuals will need to be vigilant monitoring for possible online identity theft from this ransomware incident. People should check their credit reports for suspicious entries and also place freezes and fraud alerts on your accounts.”
As cyberattacks targeting the healthcare sector persist, companies in the industry face increasing pressure to enhance their security measures and protect sensitive patient data from malicious actors.
###