It stemmed from a massive breach at Accellion, a company that sells tools to transfer files, that's affected companies across industries. Hackers reportedly took advantage of vulnerabilities in Accellion's file transfer service to gain access to its customers' files. In some cases, hackers have threatened to publish sensitive data if the victim organizations don't pay.
The Department of Homeland Security's Cybersecurity and Infrastructure Security Agency last month published an advisory on the vulnerabilities in Accellion's service.
The incident at Accellion affected customers of Kroger's healthcare arm, Kroger Health, which runs pharmacies and clinics, as well as customers of Kroger Money Services and the HR records of some current and former employees at the company. Kroger was not the only healthcare organization hit in a hack at Accellion; a health plan in Oregon has also reported being affected.
Kroger in a notice posted online said it discontinued using Accellion's services after being informed of the incident in January. HHS gives HIPAA-covered entities 60 days from when they discover a breach to notify the department, so many of the incidents reported to OCR in February were discovered in December and may have taken place even earlier.
The second- and third-largest breaches reported in February involved an email breach at home-care provider Elara Caring and a ransomware attack at eye-care provider Cochise Eye and Laser.
As of March 10, OCR had posted 40 breach reports that organizations submitted to the agency in February. Hacking and IT incidents accounted for nearly three-quarters of the breaches. The remaining breaches resulted from loss, theft and unauthorized access or disclosure.
