73 Email Accounts Compromised in Major Phishing Attack on NCH Healthcare System
The importance of security awareness training for healthcare employees has been highlighted by a recent phishing attack on Bonita Springs, FL-based NCH Healthcare System.
The attack was detected on June 14, 2019 when suspicious email activity was identified in relation to its payroll system. The investigation revealed a staggering 73 employees had responded to phishing emails and disclosed their account credentials to the scammers.
It is common for healthcare organizations to identify an email account breach and later discover the attack was more extensive than originally thought. Oftentimes, several emails accounts are discovered to have been compromised, often as a result of lateral phishing – the use of one compromised email account to send phishing emails to other individuals in the organization. However, a breach as extensive as this is fortunately rare.
NCH Healthcare system is still investigating the attack and is being assisted by a third-party computer forensics firm. The initial findings of the investigation suggest the attackers were not concerned with obtaining PHI, instead the goal of the attackers appears to have been to redirect payroll payments.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The forensic team confirmed on July 2, 2019 that some patient information was exposed as a result of the attack, but as the investigation is still ongoing, at this stage no confirmation has been issued on the types of information that were potentially compromised. Affected individuals will be notified accordingly when the investigation has concluded.
That process is likely to take some time given the extent of the breach and the number of emails in the compromised accounts that need to be checked to determine whether they contain protected health information.
NCH compliance officer Kelly Daly said the security measures put in place prior to the phishing attack limited the harm caused. Without those measures, more of the company’s 5,000 employees could also have fallen for the scam.
No reports have been received to date that suggest patients’ PHI has been misused, but patients are being advised to monitor their explanation of benefits statements and accounts for signs of identity theft and other misuses of their personal information.
The breach report submitted to the HHS’ Office for Civil Rights on February 27, 2019 indicates 63,581 individuals were affected by the breach.
