More Than 447K Patients Affected by Phishing Attack on Orlando Family Physicians
Email accounts containing the protected health information of 447,426 patients of Orlando Family Physicians in Florida have been accessed by an unauthorized individual.
Orlando Family Physicians said the first email account was compromised on April 15, 2021 as a result of an employee responding to a phishing email and disclosing their account credentials. Action was promptly taken to block unauthorized access, and an investigation was launched to determine the nature and extent of the breach.
Assisted by a leading cybersecurity forensics firm, Orlando Family Physicians determined that an additional three employee email accounts had also been subjected to unauthorized access. All four of the compromised email accounts had external access blocked within 24 hours of the initial unauthored account access.
Orlando Family Physicians determined on May 21, 2021, that the unauthorized individual potentially accessed emails in the account that contained patients’ protected health information. A review of the emails and attachments was conducted, and on July 9, 2021, Orlando Family Physicians was able to identify all affected individuals.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The email accounts contained the personal and protected health information of current patients, potential patients, employees, and other individuals. The types of information in the accounts varied from individual to individual and included one or more of the following types of data: Names, demographic information, diagnoses, provider names, prescriptions, health insurance information (Medicare beneficiary number or other subscriber identification number), patient account numbers, medical record numbers, and passport numbers.
The attack appears to have been conducted with the aim of committing financial fraud against the practice, rather than to obtain patient data; however, since unauthorized data access and exfiltration could not be ruled out, affected individuals have been advised to exercise caution and closely check their financial accounts and explanation of benefits statements for signs of fraudulent activity.
Orlando Family Physicians has enhanced its technical security measures following the breach and supplemental training on email security is being provided to the workforce.
