A national hospital network that owns two metro-east hospitals has confirmed that an overseas hacker group has stolen 4.5 million patients' personal data.
Community Health Systems filed documents with the federal government confirming that in April and June, a "highly sophisticated" hacker group in China used malware and technology to bypass the company's security measures.
Among the hospitals affected by the breach are Gateway Regional Medical Center in Granite City and Red Bud Regional Hospital. CHS is based in Franklin, Tenn., and owns 206 hospitals in 29 states.
The data transferred includes non-medical patient identification, according to the filing, including names, addresses, birth dates and Social Security numbers. However, credit card, medical or clinical information was not breached, according to the filing.
Gateway Regional's compromised data likely belonged to some patients seen at physician practices and clinics affiliated with the hospital over the past five years, according to spokeswoman Erin Echelmeyer.
"We take very seriously the security and confidentiality of private patient information and we sincerely regret any concern or inconvenience to patients," Eckelmeyer said in a statement.
Red Bud officials could not be immediately reached for comment.
Affected patients will be notified by CHS and offered identity theft protection services. Echelmeyer said CHS has installed new software to protect against future attacks. The company is working with federal law enforcement and will support prosecution of those responsible, she said.
"Many American companies and organizations have been victimized by foreign-based cyber intrusions," Eckelmeyer said. "It is up to the federal government to create a national cyber defense that can prevent this type of criminal invasion from happening in the future."
In 2007, CHS acquired Triad Hospitals, and earlier this year it acquired Health Management Associates, making CHS the largest publicly traded hospital corporation in the nation as measured by the number of hospital facilities. It employs more than 135,000 and 22,000 physicians.
Letters to affected patients should be received by Aug. 30, Echelmeyer said.