Hawaiian Aloha Nursing Rehab Centre data breach affects 20,000+ patients

One-sentence summary:

Hawaiian Aloha Nursing Rehab Centre had a data breach in July 2022 involving 20,000+ patients, and this breach was not discovered until almost six months later.

Who was involved?

Aloha Nursing Rehab Centre, 20,000 patients, and a threat actor.

What was the timeline?

July 8, 2022: Threat actor accesses the information.

December 28, 2022: Aloha Nursing Rehab Centre discovers the breach.

February 24, 2023: Aloha Nursing Rehab Centre begins breach victim notification.

What occurred?

Through an unknown or undisclosed method, a threat actor broke into Aloha Nursing Rehab Centre’s information systems and accessed the sensitive data of over 20,000+ patients in July 2022 (Console, 2023; Aloha Nursing Rehab Centre, 2023b; Dawson, 2023). The breached information included: “full names, dates of birth, Social Security numbers, financial account information, driver’s license or state identification numbers, medical record and/or patient account numbers, health information, and health insurance information” (Aloha Nursing Rehab Centre, 2023b, p. 1).

Estimated costs:

Incident response costs, M-F Call center, IDX 12-month identify theft protection subscription, “leading cybersecurity experts” (Aloha Nursing Rehab Centre, 2023a, p. 1),

Involved laws:

Federal: HIPAA and HITECH.

State laws: Maine: 10 M.R.S.A. § 1346

Root cause:

TBA or N/A (see disclaimer)

Lessons learned:

TBA or N/A (see disclaimer)

Sources:

Aloha Nursing Rehab Centre. (2023a). Aloha Nursing – Notification Letter (General SSN) (redacted) (11019713x7AB84).pdf. In Office of Maine Attorney General. Office of Maine Attorney General. Retrieved March 9, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/52a96e3a-6116-4ce9-859b-3431d3674518/d773ff01-57be-42c6-b48f-53d01a64f616/document.html

Aloha Nursing Rehab Centre. (2023b). Aloha Nursing Rehab Centre Notice of Data Security Incident. In Aloha Nursing. Aloha Nursing. Retrieved March 9, 2023, from https://www.alohanursing.com/data/Notices/Final%20Press%20Release%20-%20Aloha%20Nursing%20Rehab%20Centre%20-%202-24-23.pdf

Console, R., Jr. (2023, March 3). Aloha Nursing Rehab Centre Reports 2022 Data Breach Affecting More Than 20k Patients. JD Supra. Retrieved March 9, 2023, from https://www.jdsupra.com/legalnews/aloha-nursing-rehab-centre-reports-2022-3681534/

Dawson, B. (2023, February 24). Office of the Maine AG: Consumer Protection: Privacy, Identity Theft and Data Security Breaches. Office of the Maine Attorney General. Retrieved March 9, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/52a96e3a-6116-4ce9-859b-3431d3674518.shtml

About Post Author

Kyler Kent CISSP

Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike’s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation—turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master’s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect – Professional, AWS Security – Specialty, and multiple CrowdStrike credentials. He writes to close the gap between “what the textbook says” and what analysts actually do on shift with his published book: "SOC Analyst Career Guide" (ISBN-13: 9781835467466). https://linktr.ee/kentprotect.com Corrections: [email protected]

http://kylerkent.com