Security Breach of VA Prescription Monitoring Program

Sandra Whitley Ryals, director of the Virginia Department of Health Professions, issued the following statement Wednesday regarding a potential breach of security for the Prescription Monitoring Program mandated by Virginia state law:

“A criminal investigation is currently underway regarding a potential security breach of the Virginia Department of Health Profession’s Prescription Monitoring Program on Thursday, April 30. While DHP cannot comment directly on an ongoing investigation, we can assure the public that all precautions are being taken for DHP operations to continue safely and
securely.

“Since last week, when DHP recognized an unauthorized message was posted on the Prescription Monitoring Program Website, we have been working very closely and cooperatively with federal and state law enforcement to resolve the situation. The entire DHP system has been shut down since Thursday to protect the security of the program data, and state authorities including the Virginia Information Technologies Agency and the Virginia State Police were notified immediately upon identifying the potential breach.We are satisfied that all data was properly backed up and that these backup files have been secured.

“As the criminal investigation permits, we will be sharing additional details in the coming days on the agency’s Website including questions and answers for concerned program participants.”

The FBI is investigating a report that hackers have accessed millions of patient and prescription records collected by the program, which aims to reduce drug abuse, theft and illegal sale of prescription drugs. The hackers
reportedly are seeking a $10 million ransom for their return.

The alleged security breach was reported on WikiLeaks, an online clearinghouse for anonymously leaked documents. The site said eight million patient records and 35 million prescriptions were accessed.