ATLANTA — Thousands of private medical photos of breast cancer patients were leaked online as part of a ransomware attack this month.
The leaked images were not only mammograms, but also full frontal photos taken of patient’s breasts, many with their face in them.
Silvia Garcia, a breast cancer survivor from Atlanta, said she's horrified this happened when they’re already going through so much.
“To think that maybe my picture could have been there, thinking that a stranger saw that, is horrifying but infuriating, too," Garcia said. "Why? Why would someone wants to do that after we've been through so much?”
Patrick Kelley is a cybersecurity expert and founder of Critical Path Security. He said he was shocked when he discovered the leak.
“This one has me shook a little bit, being totally honest," Kelley said. "Not just test results, not just their names and addresses, but like full body photos of these people. To me it's just one of the worst breaches I think I've ever seen. There are photos of you at your most vulnerable time.”
Kelley said the information primarily came from Lehigh Valley Health System in Pennsylvania, but similar breaches may also include patients in Georgia.
"Just this morning we've had five more health care breaches," Kelley said. "The more damaging, the more salacious, the more impacting that the information is, the greater chance that they're going to get paid.”
It's left survivors like Garcia questioning everything.
“We have to sign a lot of forms about who can have access and all this, but how secure is it?" she said. "I mean, is it really secure? I don't know. And it's scary to think that anybody could just access all of my information.”
Garcia was 31 years old when she discovered a lump in her breast. That year, in March 2020, she was diagnosed with Stage 2B Triple-negative breast cancer.
“I underwent 16 rounds of chemo, chose to have a bilateral mastectomy, which means they removed both breasts," Garcia said. "It was a long process. I have 10 specialists that I see.”
For so long she said her focus was solely on surviving.
“I couldn't stand up straight, I couldn't bathe myself, I couldn't even get up from the couch," she said. "I remember one day waking up and saying, if this is what it takes to have breast, I don't even know if it's worth it.”
Garcia is now in remission and working with the East Georgia Cancer Coalition to support other breast cancer patients, hoping to spread awareness and protect survivors.
Kelley said patients should feel empowered to ask questions during their appointments.
“Ask, do you have to take these photos?" he suggested. "What are you going to do with these photos? How long you keeping this data?”
Lehigh disclosed what happened in a letter from the CEO.
Kelley said they did not pay the ransom the hackers demanded. His team provided a screenshot to 11Alive of a post made by the hackers, accompanying the leaked data.
“Because your hypocritical leadership has told the media that patient data comes first, but refuses to pay us, we will publish more confidential data every week," the hacker group wrote. "Nu [sic] pictures of patients and all their data, we're ready to get started!"
At least one class action lawsuit has been brought against Lehigh Valley Health Network, claiming their refusal to pay the ransom demand "prioritized money over patient privacy."
That lawsuit was filed Monday in Lackawanna County, Pennsylvania, and states the leak contains photos of patients taken during treatments, often unbeknownst to the patients themselves.
In their disclosure, Lehigh Valley Health Network President and CEO Dr. Brian Nester said, "attacks like this are reprehensible and we are dedicating appropriate resources to respond to this incident."
He added that they will "provide notices to individuals as required as soon as possible."
Garcia, a representative for the East Georgia Cancer Coalition, encouraged patients and survivors to reach out to them for support and resources.
She said they offer several unique programs including exercise classes. complementary massage therapy, free screenings and farm to table learning sessions.
You can learn more about their offerings here.
The East Georgia Cancer Coalition is a 501(c)(3) regional cancer nonprofit organization that serves 53 counties of East Georgia. You can learn more about how to donate or volunteer here.