Breach Report: One Brooklyn Health suspected ransomware attack affects 235,000+, patients notified 9 months after, decried for silence, results in “chaos,” systems crash, and lawsuit

One-sentence summary:

One Brooklyn Health suffered a suspected ransomware attack and data breach for over 4 months, resulting in the notification of 235,000+ patients 9 months after the breach’s start as well as a public outcry, chaos, systems, crash, and a class-action lawsuit.

Who was involved?

One Brooklyn Health System and its member hospitals: Interfaith Medical Center, Brookdale Hospital Medical Center, and Kingsbrook Jewish Medical Center, 235,251 patients and individuals, and a threat actor.

What was the timeline?

July 9, 2022: Breach starts and threat actor gains initial access to One Brooklyn Health

November 19, 2022: Breach leads to “cyberattack” operational disruption and ends

November 29, 2022: Network is reported to still be offline and patients are being transferred elsewhere (Campanile, 2022)

December 21, 2022: Multiple news sources report One Brooklyn Health is still “relying on paper records”

January 23, 2023: One Brooklyn Health finally publicly confirms data breach amidst public outcry from silence (McGee, 2022; Davis, 2023)

March 21, 2023: One Brooklyn Health discovers PHI and PII were breached in the cyberattack

April 20, 2023: One Brooklyn Health posts data breach notice on website and notifies Maine OAG, begins consumer notification

April 26, 2023: Class action lawsuit is filed in Kings County, NY against One Brooklyn Health (Johnson v. One Brooklyn Health, 2023)

What occurred?

One Brooklyn Health System (with several of its hospitals) was breached in July 2022 in a suspected ransomware attack, causing significant operational disruption and the transfer of patients almost four months later (McGee, 2022; Campanile, 2022). “All computer systems” were affected and “chaos” was reported (Davis, 2023; Campanile, 2022). The Health-ISAC (Health Information Sharing and Analysis Center) reported a public outcry for the hospital’s silence on the issue as One Brooklyn Health did not publicly confirm the circumstances for some time despite transferring patients and facing severe operational disruption (McGee, 2022; Davis, 2023; Campanile, 2022). The cyberattack resulted in the potential breach of protected health information (PHI) and personally identifiable information (PII) for over 235,251 patients and individuals (Brown, 2023). Breached information potentially included: “names, Social Security numbers, driver’s license or state identification numbers, dates of birth, financial account information, medical treatment information, prescription information, medical diagnosis or condition information, and health insurance information” (One Brooklyn Health, 2023). The breach resulted in a class-action lawsuit being filed 6 days after the second major breach notification (Johnson v. One Brooklyn Health, 2023).

Estimated costs:

Associated incident response costs, breach notification costs, potential operational costs due to outage, repair, downtime, and lost healthcare business, litigation defense, M-F call center, 12 months of Cyberscout credit monitoring services

Involved laws:

Federal: HIPAA and HITECH

State: New York N.Y. GEN. BUS. LAW §§ 349 and 350 (Johnson v. One Brooklyn Health, 2023, p. 3)

Root cause:

TBA or N/A (see disclaimer)

Lessons learned:

TBA or N/A (see disclaimer)

Sources:

Brown, L. (2023). Data Breach Notifications. In Privacy, Identity Theft and Data Security Breaches. Office of the Maine Attorney General. Retrieved May 1, 2023, from https://apps.web.maine.gov/online/aeviewer/ME/40/73e780c9-ea42-4b82-9d46-41bc962aceb5.shtml

Campanile, C. (2022, November 29). Computer crash causes chaos at Brooklyn hospitals network with ties to Hochul. New York Post. https://nypost.com/2022/11/29/it-network-crash-at-brooklyn-hospitals-with-ties-to-hochul/

Davis, J. (2023). Breach notice confirms One Brooklyn Health cyberattack, outage in November. SC Media. https://www.scmagazine.com/analysis/breach/breach-notice-confirms-one-brooklyn-health-cyberattack-outage-in-november

Johnson v. One Brooklyn Health, NYSCEF DOC. NO. 2 (K.C.N.Y. 2023). https://s3.documentcloud.org/documents/23790655/johnson-v-one-brooklyn-health-as-filed-complaint-42623.pdf

Lyngaas, S. (2022, December 20). Brooklyn hospital network reverts to paper charts for weeks after cyberattack. CNN. https://www.cnn.com/2022/12/20/tech/hospital-ransomware/index.html

McGee, M. K. (2022). Brooklyn Hospitals Decried for Silence on Cyber Incident. Health-ISAC – Health Information Sharing and Analysis Center. https://h-isac.org/brooklyn-hospitals-decried-for-silence-on-cyber-incident/

One Brooklyn Health. (n.d.). obh-logo-placeholder.png. onebrooklynhealth.org. https://onebrooklynhealth.org/media/e4kfwzu1/obh-logo-placeholder.png

One Brooklyn Health. (2023). One Brooklyn Health Provides Notice of Data Security Incident. In onebrooklynhealth.org. One Brooklyn Health System. Retrieved May 1, 2023, from https://onebrooklynhealth.org/media/p4abqfwk/obh-website-notice.pdf

About Post Author

Kyler Kent CISSP

Kyler Kent is a Senior Cybersecurity Analyst on CrowdStrike’s Falcon Complete MDR team, where he helps large enterprises detect, investigate, and contain real intrusions across cloud and hybrid environments. His work spans threat hunting, incident response, and security automation—turning noisy telemetry into clear, repeatable actions that reduce risk quickly. Previously, Kyler served as a Threat Hunting and Intelligence Specialist supporting a critical infrastructure provider in Dallas, and led security automation and operational coordination at CyberConvoy. He holds a Master’s in Cybersecurity Risk Management from Georgetown University and maintains certifications including CISSP, AWS Solutions Architect – Professional, AWS Security – Specialty, and multiple CrowdStrike credentials. He writes to close the gap between “what the textbook says” and what analysts actually do on shift with his published book: "SOC Analyst Career Guide" (ISBN-13: 9781835467466). https://linktr.ee/kentprotect.com Corrections: [email protected]

http://kylerkent.com