23K Patients of Mayfield Clinic Sent Malware-Infected Email
In February, patients of the Mayfield Clinic of Cincinnati, Ohio were sent an email containing a malicious attachment which downloaded ransomware onto their devices. The entry on the HHS’ Office for Civil Rights breach portal indicates 23,341 patients were sent the email, although it is unclear how many email recipients opened the malicious attachment and infected their computers.
The email was sent by an individual who gained access to a database held by one of Mayfield’s vendors. That vendor was contracted to send out newsletters, invitations, announcements, and educational information via email to patients, event attendees, business associates, website contacts, and other friends of Mayfield.
The emails were sent out on February 23, 2016 and had the subject line “Important Information: invoice 11471.” Opening the attached file triggered the download of ransomware – malware that encrypts files preventing them from being accessed. The victims are then told they must pay a ransom to obtain the key to unlock the encryption.
The individual who gained access to the email database was only able to access email addresses. No medical data, Social Security numbers, or personal information was accessed. The vendor was only supplied with a list of emails.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The security breach was rapidly identified allowing Mayfield to alert many of the people on the email list the same day. Mayfield posted a security announcement in a prominent place on its website and sent out announcements via social media. An email update was also sent two days later, a press release was issued, and letters were mailed to affected individuals. The email account used to send the malicious email has been locked to prevent further access.
The security breach triggered an investigation and review of policies and procedures and Mayfield has worked with its vendor to ensure that similar incidents are prevented in the future.
Mayfield also used a computer virus protection service to determine whether the email and the attached file contained a virus. All recipients of the malicious email have now been sent a link which they can use to download software to remove the ransomware infection.
