Baylor College of Medicine was informed of a cybersecurity incident involving Advarra, a vendor the College uses to provide clinical research information services for clinical trials. The incident, which occurred in October 2023, may have impacted study participants in breast cancer research at the Dan L Duncan Comprehensive Cancer Center at Baylor from 1999 to 2013.
Advarra promptly responded to the incident by disabling the employee’s account and launching an investigation to determine the extent of the unauthorized access. After conducting a thorough review, Advarra identified that certain files containing names and dates of birth of participants in studies from 1999 to 2013 were accessed. However, the incident did not involve any access to College systems, network, or electronic health records.
In response to the incident, Advarra is providing affected individuals complimentary credit monitoring services for 24 months. The services include credit monitoring, fraud consultation, and identity theft restoration. Advarra emphasized that while there have been no reports of identity theft or fraud related to the acquired information, they are taking proactive measures to safeguard the affected individuals.
Advarra expressed regret for any inconvenience caused to the study participants, stating, "Advarra takes this event and the security of information in its care seriously." Affected individuals who have questions or wish to avail themselves of the complimentary credit monitoring services can contact Advarra at (866) 983-9303 during business hours.
If study participants at the Duncan Cancer Center want to ascertain if their information was impacted by the incident, they are encouraged to reach out to Advarra at the provided contact number.
The incident serves as a reminder of the importance of robust cybersecurity measures in safeguarding sensitive information, particularly in the healthcare and research sectors. Advarra's proactive response and commitment to enhancing information security underscore the significance of prompt action in addressing cybersecurity incidents to mitigate potential risks to data privacy and security.
