PHOENIX–Banner Health, which operates 29 hospitals, reported it suffered a data breach that could affect up to 3.7 million people.
The company said in response to the "sophisticated cyberattack” it has hired a forensics firm to investigate, has taken steps to block the attackers, and has alerted law enforcement.
The company said the attackers gained unauthorized access to payment card processing systems at some of its food and beverage outlets, access that was then used to access a variety of healthcare-related information.
Banner Health said it discovered the hack of card processing systems on July 7, with cardholders' names, card numbers, expiration dates and verification codes having been exposed. Cards used at affected outlets between June 23 and July 7 were affected. Card transactions used to pay for medical services were not affected, it said.
Affected individuals are being offered one year of credit ID theft monitoring services. Banner Health IT issued a statement saying it is "further enhancing the security of our systems to help prevent something like this from happening again."
In addition to the card-related breach, "On July 13, Banner Health learned that cyberattackers may have gained unauthorized access to patient information, health plan member and beneficiary information, as well as information about physician and healthcare providers," the company said in a statement.