BreachWatch™: Ascension

Snapshot

• Incident type: Ransomware originating via a third‑party contractor (a former business partner).
• Operational impact: Core systems- including electronic health records (EHR) were disrupted; teams shifted to manual processes.
• Data exposure risk: Scope under investigation; patient data and operational integrity potentially affected.
• Underlying control gap: Vendor offboarding– access and data custody were not fully closed out with the former partner (FBP), including assurance of secure data destruction.

Why it matters: This is not only a “cyber” event, it’s a vendor lifecycle failure. Offboarding is a legal and operational safeguard, not a formality.

What happened

A former business partner (FBP) tied to Ascension was compromised by a cybercriminal group using ransomware. Based on available information, the FBP appears to have maintained outdated security practices, creating an entry point. The incident disrupted critical operations across clinical systems, labs, and patient services, and forced a temporary reversion to manual workflows while the scope of potential patient‑data exposure was evaluated.

VRM takeaways

1. Offboarding is a control, not a courtesy. Every asset and data flow must be revoked, returned, or destroyed – and documented.
2. Former partners still create current risk. Residual credentials, data copies, and shadow integrations often linger.
3. Trust the proof, not the promise. Vendor self‑attestations aren’t enough; you need continuous validation and correlation to prove controls are operating.

How Perimeter would have helped

Perimeter delivers Painless VRM: end‑to‑end, continuous, and real‑time. Here’s how the platform addresses the specific failure modes in this incident:

1) Close the loop on vendor offboarding

• Assess: Policy‑driven workflows to initiate offboarding when a relationship ends or risk changes.
• Share: Collect attestations and evidence from the FBP (e.g., certificate of destruction, access‑termination confirmations) with an auditable trail.
• Respond: Prebuilt playbooks to orchestrate the offboarding tasks across security, legal, and operations.

2) Validate vendor claims continuously

• Verify: Ongoing checks that flag weak vendor hygiene and correlate findings to stated controls- so gaps surface before they become incidents.
• Monitor: Breach and threat signals tied to specific vendors to trigger reassessment or offboarding workflows automatically.

3) Turn contracts and documents into action

• Extract: Parse BAAs, MSAs, and SOWs to surface data‑retention and destruction obligations, then auto‑create offboarding tasks with cited clauses.

Control checklist (use now)

• Revoke all credentials, integrations, and network paths for former vendors (FBPs).
• Confirm and file proof of data deletion/destruction in the vendor record.
• Track residual data custody (backups, test environments, analytics copies) to closure.
• Validate ongoing control adherence with automated checks; don’t rely on static questionnaires.
• Trigger reassessment or offboarding when breach signals appear- automatically, not ad hoc.

Bottom line

This incident underscores a simple principle: If you can’t prove it, it didn’t happen. Perimeter helps organizations prove offboarding, validation, and data‑custody controls- so third‑party risk doesn’t become a patient‑care crisis.