A third-party data breach affected 48,879 patients, providers and employees of UCHealth, the Aurora, Colo.-based health system reported.
A hacker infiltrated the servers of Diligent Corp., a business operations software company, accessing and downloading attachments that included UCHealth files, according to the Jan. 17 notice on the health system's website.
UCHealth said its email and EHR systems were not affected, but that names, addresses, treatment information, Social Security numbers and financial data may have been downloaded. The health system said it has no reason to believe the data has been misused, and that the vendor has taken added steps to protect the data and prevent this type of cyberattack from happening in the future.