Radius Global Solutions

# Radius Global Solutions Data Breach Report ## Incident Overview Radius Global Solutions, a Pennsylvania-based healthcare organization, experienced a significant data breach involving unauthorized access to its network server infrastructure. The breach was reported to the U.S. Department of Health and Human Services on October 19, 2023, affecting 135,742 individuals. The incident represents a hacking or IT-related compromise of the organization's computer systems, resulting in potential exposure of protected health information (PHI) maintained on networked servers. This type of breach typically involves exploitation of network vulnerabilities, credential compromise, or other cyber attack vectors that allowed unauthorized actors to gain access to systems containing sensitive patient data. ## Company Response and Investigation Upon discovery of the unauthorized access to its network server, Radius Global Solutions initiated an investigation to determine the scope and nature of the compromise. The organization worked to identify affected individuals, assess what information may have been accessed, and implement remediation measures to secure its systems. The breach was formally reported to HHS within the required notification timeframe, with the submission date of October 19, 2023, indicating the organization met federal notification requirements under the HIPAA Breach Notification Rule. The investigation process typically involves forensic analysis of network logs, system access records, and affected data repositories to establish the timeline of unauthorized access and identify the specific information compromised. ## Technical Details of the Breach Network server breaches of this nature typically result from one or more of the following attack vectors: exploitation of unpatched software vulnerabilities, weak or compromised authentication credentials, phishing attacks targeting employee access, inadequate network segmentation, or insufficient monitoring of network traffic and access logs. The location of the breach on a network server indicates that the compromised systems were connected to the organization's internal network infrastructure, potentially providing access to multiple data repositories and patient records simultaneously. Attackers who gain access to network servers can potentially exfiltrate large volumes of data, maintain persistent access for extended periods, and move laterally through connected systems. The scale of this breach—affecting over 135,000 individuals—suggests either a prolonged period of undetected access or compromise of a centralized system containing records for a substantial patient population. ## Organizational Context Radius Global Solutions operates as a healthcare-related entity in Pennsylvania, likely providing services such as billing, claims processing, health information management, or other administrative healthcare functions. As a business associate involved in this breach, the organization handled protected health information on behalf of covered entities such as hospitals, physician practices, or health plans. Business associates are required under HIPAA regulations to maintain appropriate safeguards for PHI and to notify affected individuals and covered entities in the event of a breach. The involvement of a business associate in a breach of this magnitude can have cascading effects, potentially impacting multiple healthcare providers and their patient populations who rely on the organization's services. ## Patient Impact and Affected Population The breach affected 135,742 individuals whose health information was stored on Radius Global Solutions' compromised network servers. These individuals likely include patients of multiple healthcare providers who utilize the organization's services. The specific types of personal health information that may have been exposed depend on the nature of the data maintained on the breached servers but typically includes information such as names, dates of birth, Social Security numbers, medical record numbers, insurance information, and clinical data. Affected individuals were notified of the breach through written notification letters, as required by the HIPAA Breach Notification Rule. The notification process for breaches affecting this number of individuals typically involves coordination with covered entities, state attorneys general, and potentially media outlets, depending on the number of affected residents in any single state. ## HIPAA Compliance and Industry Context Under the HIPAA Breach Notification Rule (45 CFR §§ 164.400-414), covered entities and business associates must notify affected individuals of breaches of unsecured PHI without unreasonable delay and in no case later than 60 calendar days after discovery of the breach. Network server breaches represent a significant category of healthcare data breaches, accounting for a substantial portion of reported incidents in recent years. According to HHS breach notification data, hacking and IT incidents have become increasingly common, often resulting in large-scale compromises affecting thousands or hundreds of thousands of individuals. The healthcare industry remains a primary target for cyber attacks due to the high value of health information on the dark web and the critical nature of healthcare systems. Organizations are required to implement administrative, physical, and technical safeguards to protect PHI, including access controls, encryption, audit logging, and regular security assessments. This breach underscores the importance of strong cybersecurity practices, including network monitoring, vulnerability management, employee security training, and incident response planning.

# Radius Global Solutions Data Breach Report ## Breach Overview Radius Global Solutions, a Minnesota-based healthcare organization, experienced a significant data breach involving unauthorized access to its network server infrastructure. The breach was discovered and reported to the U.S. Department of Health and Human Services on August 4, 2023, affecting approximately 600,794 individuals. This incident represents a substantial compromise of protected health information (PHI) stored on the organization's networked systems, likely resulting from exploitation of network vulnerabilities or inadequate access controls. ## Discovery and Response Timeline The specific date of breach discovery was not disclosed in the initial notification, though the submission to HHS occurred on August 4, 2023, which typically indicates discovery within 30-60 days prior to notification in accordance with HIPAA Breach Notification Rule requirements. Upon discovery, Radius Global Solutions initiated a forensic investigation to determine the scope of unauthorized access, identify affected individuals, and assess what categories of protected health information may have been compromised. The organization notified affected individuals through written correspondence and established a dedicated breach response program, including credit monitoring services where applicable. The involvement of a business associate in this breach suggests that Radius Global Solutions may have been processing or storing data on behalf of covered entities, making the breach notification requirements particularly stringent under HIPAA regulations. ## Technical Breach Details The breach occurred on a network server, which typically indicates that attackers gained unauthorized access to centralized data storage systems rather than individual workstations or portable devices. Network server breaches of this magnitude usually result from one or more of the following vectors: exploitation of unpatched software vulnerabilities, weak or compromised credentials, inadequate network segmentation, insufficient firewall rules, or social engineering attacks targeting administrative personnel. The fact that over 600,000 individuals were affected suggests either a prolonged period of unauthorized access before detection or a broad compromise affecting multiple data repositories on the network infrastructure. Network-based breaches often allow attackers extended dwell time—the period between initial compromise and detection—which can range from weeks to months, significantly increasing the volume of data potentially exfiltrated. ## Organizational Context and Operations Radius Global Solutions operates as a healthcare service provider in Minnesota, likely providing business services, data management, billing, or administrative support to healthcare entities across multiple states. The organization's classification as involving a business associate indicates it processes sensitive health information on behalf of covered entities such as hospitals, physician practices, or health plans. The scale of the breach—affecting over 600,000 individuals—suggests Radius Global Solutions maintains substantial databases of patient information, potentially including records from multiple healthcare organizations. This business model creates heightened responsibility under HIPAA, as business associates must maintain equivalent security standards to covered entities and are subject to direct enforcement by HHS Office for Civil Rights. ## Impact on Affected Individuals Approximately 600,794 individuals had their protected health information potentially accessed during this breach. While the specific data elements compromised were not detailed in the breach notification summary, network server breaches of this scope typically involve access to multiple categories of PHI, which may include names, dates of birth, Social Security numbers, medical record numbers, insurance information, clinical diagnoses, treatment histories, and financial account details. The notification process required Radius Global Solutions to contact all affected individuals, provide details about the breach, explain the types of information compromised, and offer complimentary credit monitoring and identity theft protection services for a specified period (typically 12-24 months). Individuals were advised to monitor their credit reports, review explanation of benefits statements, and remain vigilant for signs of identity theft or fraudulent medical billing. ## HIPAA Compliance and Industry Context Under the HIPAA Breach Notification Rule, covered entities and business associates must notify affected individuals without unreasonable delay and no later than 60 calendar days after discovery of a breach of unsecured PHI. Additionally, notification must be provided to the media if the breach affects more than 500 residents of a state or jurisdiction, and to HHS. Network server breaches represent a significant category of healthcare data breaches, accounting for a substantial percentage of incidents affecting large numbers of individuals. According to HHS breach statistics, hacking and IT incidents have consistently ranked among the top breach types by volume of affected individuals, often surpassing theft and loss incidents. The involvement of a business associate in this breach underscores the importance of vendor risk management and the extension of HIPAA security requirements throughout the healthcare ecosystem. Organizations that fail to implement adequate network security controls, including regular vulnerability assessments, patch management, intrusion detection systems, and access controls, face significant regulatory penalties and reputational damage.