Equinox Sends Data Theft Notification to 21K Patients and Staff

Equinox, a health service organization based in New York, has sent a notice to nearly 21,000 patients and staff informing them of a data breach incident that occurred nearly seven months ago.

Equinox faced issues accessing parts of its network resources on April 29, 2024, which turned out to be a security breach. Investigations began almost immediately and the company took all measures possible to re-secure their infrastructure.

A well-known cybersecurity firm was also hired (not named in the notice) to investigate the issue. The company then launched a detailed review of the files that were suspected of being affected. 

After some intense and long investigation, Equinox concluded on September 16, 2024, that the personal health information of some of its customers and staff had been compromised. Breached information includes the following:

However, Equinox has said that this list is not exhaustive and the details breached may differ from individual to individual.

Who’s Responsible For the Attack?

What’s more embarrassing for security and law enforcement agencies around the world is that the notorious ransomware gang Lockbit is responsible for this data leak.

Now, Lockbit was neutralized in February 2024 through a joint operation of the FBI, Europol’s European Cybercrime Center, and the Interpol led by Britain’s National Crime Agency. This operation was also supported by countries like France, Japan, Australia, Germany, and others.

After such a huge operation, the National Crime Agency said that the site was under their control and that the gang was disrupted successfully.

So, in April, when the Equinox incident occurred, Lockbit shouldn’t have been active. However, that isn’t the case – two months after their ‘supposed’ disruption, Lockbit was successful in executing another data breach.

The LockBit 3.0 ransomware group listed Equinox on its data leak site on May 18, claiming to have 49GB of crucial data. This listing was updated on August 11, which gave Equinox time till August 25 to comply with the gang’s request. Post this, Lockbit went on to leak 31.8 GB worth of personal information online.

However, Equinox has not yet confirmed whether it was a ransomware attack or the amount demanded by the gang, if any.

What Can Equinox Customers Do Now?

Well, now that personal customer data has already been leaked, there’s not much users can do about it. However, Equinox has listed a few measures people can take to ensure this leaked data is not misused.

You can review your credit reports and account statements and if you notice anything suspicious, you should immediately contact your financial institution.

You can place a fraud alert on your credit report – doing so is absolutely free and it stays on your credit file for one year at least. This will notify you of any fraudulent activity on your report. Plus, perpetrators will not be able to open any new accounts in your name, as the financial institution will contact you before doing so.

You can also put a security freeze on your credit file, which prevents any new credits from being opened against your name without a PIN number. This way, no one will be able to access your credit reports without your permission.

Equinox takes the security and privacy of information in its possession very seriously and is taking steps to prevent a similar event from occurring in the future. – Equinox

Equinox has also set up a toll-free number for any security queries customers might have. You can contact them on (866) 531-3185, Monday through Friday from 9:00 a.m. to 9:00 p.m. Eastern Time.