AdvancedHEALTH confirms data access after clinic ransomware outage

Analyst assessment

Advanced Diagnostic Imaging, P.C. (ADI), doing business as AdvancedHEALTH, has now made a firsthand disclosure. In a June 26 notice, ADI said it identified suspicious activity in its technical environment on April 28, secured the environment and investigated. The investigation determined that an unauthorized actor gained access to certain information on ADI computer systems. ADI said it was still conducting a comprehensive review to determine what information was present and to whom it related.

That disclosure strengthens the evidence for a confirmed cyber incident and confirms unauthorized access to information, but it does not itself identify ransomware. Ransomware remains supported by Columbia Surgical Partners’ earlier patient communication: the clinic said its parent had suffered a ransomware attack and that it could not access electronic medical records. DysruptionHub and WSMV documented that operational effect at the end of April.

Operational significance

The confirmed operational impact was loss of access to electronic medical records at Columbia Surgical Partners. EHR access supports review of patient histories, scheduling, surgical preparation, documentation and continuity of care. The inability to retrieve records therefore materially impaired normal clinical administration, although public reporting did not document canceled procedures, office closures or emergency-care effects.

Columbia Surgical Partners officially lists offices in Columbia, Pulaski and Lawrenceburg. Those are supported organization locations, but the public incident communication does not say whether all three offices used the unavailable EHR environment. Columbia remains the only high-confidence incident location; Pulaski and Lawrenceburg are not treated as confirmed or suspected impacted sites without office-specific evidence.

Victim disclosure and data findings

Columbia Surgical Partners provided the first known victim-side operational disclosure by telling patients about ransomware at its parent and inaccessible records. ADI’s June 26 notice later confirmed its own investigation and unauthorized access to information. ADI said it implemented additional technical safeguards and had no evidence of actual or attempted misuse as of the notice.

The notice does not identify the types of information involved, the number of affected people, when unauthorized access began or ended, whether data was copied from the environment, or whether notices were sent to specific individuals. It therefore supports the Unauthorized data access finding, not confirmed data theft, publication or the actor’s claimed patient-record totals.

DragonForce claim

Comparitech reported that DragonForce listed AdvancedHEALTH and claimed it stole approximately 390 GB of data, including 2.3 million lines of patient information, partner agreements, management files, payroll data and human-resources records. The group also threatened incremental publication. AdvancedHEALTH has not confirmed DragonForce, the claimed volume, those data categories, exfiltration or publication. Attribution therefore remains low confidence and separate from ADI’s confirmed unauthorized-access finding.

Organization identity

The Tennessee physician group’s current official website is ouradvancedhealth.com, which describes AdvancedHEALTH as a multi-specialty group with more than 550 providers across 40 specialties. This Tennessee organization is distinct from the Oregon health-plan organization using advancedhealth.com.

Current status

ADI’s June notice describes containment, investigation and added safeguards but does not provide an operational restoration date for Columbia Surgical Partners’ EHR. Because no continuing operational impact has been documented since May 1 and no positive all-clear is available, the incident remains assessed as presumed resolved rather than resolved. The data-content review was still underway on June 26.

Confidence and uncertainty

Confidence is high that malicious cyber activity affected ADI and disrupted EHR access at Columbia Surgical Partners. The clinic’s ransomware statement and ADI’s later unauthorized-access finding are consistent but do not establish that DragonForce conducted the intrusion.

Data unavailability and unauthorized data access are confirmed. Data theft, publication and specific exposed-data categories remain unconfirmed. ADI reported no evidence of misuse, which is not equivalent to proving that no data was copied or that no future misuse could occur.

Analytic gaps

The public record does not establish the initial access vector, malware deployment method, encryption scope, affected servers, backup impact, dwell time, ransom amount, payment status, negotiation history, unauthorized-access interval or final restoration date. It also does not establish an affected-person count, final data categories, impact across AdvancedHEALTH’s broader network, or operational effects at Columbia Surgical Partners’ Pulaski and Lawrenceburg offices.