Defunct Fallon Ambulance Service breach exposed data on 911,757 people

Transformative Healthcare began notifying roughly 911,757 people on December 27, 2023 that their personal information had been taken in an intrusion involving Fallon Ambulance Service, a Boston-area medical transport company that had already shut down.

Coastal Medical Transportation Systems agreed in September 2022 to acquire Transformative Healthcare's Massachusetts medical transportation arm, including Fallon, and completed the deal on December 7, 2022, the point at which Fallon stopped operating. Transformative Healthcare retained an archived copy of Fallon's records to meet legal retention requirements. That archive was the target. Investigators concluded an unauthorized party had access between February 17 and April 22, 2023, and that suspicious activity was detected on April 21.

The exposed files varied by individual and included names, addresses, Social Security numbers, driver's license numbers, medical information such as COVID-19 testing and vaccination records, and material submitted in connection with employment or job applications.

The ALPHV/BlackCat ransomware group claimed the intrusion in May 2023 and said it had taken about one terabyte of data. Transformative Healthcare said it secured the archive, engaged outside forensic specialists, involved federal law enforcement and offered affected people two years of identity protection. It reported no evidence that the stolen information had been misused. A proposed class action naming Transformative Healthcare and Coastal Medical Transportation Systems was filed in federal court in Massachusetts shortly after the notifications went out.