Revere Health Phishing Attack Impacts 12,000 Patients
The U.S. Agency for International Development (USAID) was impersonated in a phishing campaign that resulted in the exposure of the protected health information (PHI) of approximately 12,000 patients of the Utah healthcare provider Revere Health. The phishing attack was rapidly detected by the Revere Health IT team, which quickly secured the mailbox to block unauthorized access. According to a breach notice published by Revere Health, the mailbox was only compromised for around 45 minutes on June 21, 2021.
An investigation was launched into the breach to determine whether any information in the email account was viewed or downloaded. While it was not possible to tell whether emails in the account were accessed or exfiltrated, Revere Health said it has monitored the Internet and has found no instances of patient data being shared online.
A review of emails and email attachments confirmed they contained the protected health information of patients of the Heart of Dixie Cardiology Department in St. George, which included medical record numbers, dates of birth, provider names, procedures, and insurance provider names, but no financial information or highly sensitive data.
Revere Health believes the aim of the attacker was not to gain access to patient data, but to use the email account for a more sophisticated phishing attack on Revere Health employees. Given the short window of opportunity and the limited nature of the data contained in the account, the risk to patients is perceived to be low. Patients have been advised to be vigilant against any attempted misuse of their data.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The US Agency for International Development has recently been impersonated in a phishing campaign conducted by the Russian threat group Nobelium, which was behind the SolarWinds supply chain attack. The campaign has been ongoing since early 2021. The hackers gained control of the Constant Contact email marketing account used by USAID, and the account was used to send convincing phishing emails to more than 350 organizations. In that campaign, the goal was to deliver malware by impersonating genuine USAID email communications. In late May, the U.S. Department of Justice seized two domains being used in the spear phishing campaign.
