"They also posted a file tree listing the files in the exfiltrated data. Examination of some of the files, provided to DataBreaches, confirmed that they include protected health information. As examples, DataBreaches saw surgical records on named patients that included patients' name, date of birth, full social security number, date of service and physician, health insurance information, and narratives describing the surgical procedure."
"Surprisingly, Covenant Health responded hours later, asking DataBreaches to confirm we really intended to contact them as there were other health systems with similar names. Did Covernant Health's communications team not know that they had been the victim of a breach? DataBreaches promplty responded with the relevant links demonstrating that yes, it was the Tennessee Covenant Health and AFSC that this site intended to reach. There has been no substantive reply since then, despite a second request sent."
Advanced Family Surgery Center (AFSC) in Oak Ridge, Tennessee is part of Covenant Health. Genesis claimed on November 26, 2025 that they had compromised AFSC and later contacted the facility. Negotiations reportedly occurred but went nowhere. On January 11, Genesis added AFSC to a dark‑web leak site claiming exfiltration of 100 GB of data, including healthcare, personal, financial, user folders, operational data, and company file‑server contents. Provided samples and a posted file tree confirmed protected health information including surgical records with names, dates of birth, full social security numbers, dates of service, physicians, insurance details, and procedural narratives. On January 19, DataBreaches emailed AFSC requesting a response; Covenant Health initially asked which health system was meant, and DataBreaches supplied links verifying the target. No substantive reply followed despite a second request. The leak site indicates uploading while no AFSC data has been publicly posted yet. Nearly two months have elapsed since discovery, and HIPAA requires notification to affected patients and HHS within 60 calendar days.
Read at DataBreaches.Net
Unable to calculate read time
Collection
[
|
...
]