The Center for Vitreo-Retinal Diseases in Des Plaines, Ill., posted a notice on its website after discovering its computers had been infected with ransomware Sept. 18.
The center conducted an investigation into the cyberattack, which revealed an unknown, unauthorized third party may have gained access to its servers. This server access would have enabled the hacker to view patient records, including names, addresses, phone numbers, dates of birth, insurance information, health information and — for Medicare patients — Social Security numbers.
Officials said there is no evidence the third party had accessed or viewed the information. The center mailed patients notification letters on Nov. 16.
"Although there is no evidence that the unauthorized third party actually accessed information on our system and we are not aware of any misuse of patient information, we take the privacy and security of patient information very seriously and have taken steps to prevent a similar event from occurring in the future," the notice reads.