Phishing Email Results in 108,000-Record Data Breach at Nebraska Life Insurer
United of Omaha Life Insurance Company in Nebraska has confirmed that a response to a phishing email has resulted in a breach of the protected health information of 107,894 individuals. The breach was detected on April 23, 2024, when anomalous activity was identified in an employee’s email account. United of Omaha observed unauthorized access to the account by a third party and blocked access to the account by changing the employee’s Microsoft account passwords and blocking and reporting the domain associated with the attack.
The forensic investigation confirmed that access was gained to the account following a phishing campaign targeting its employees and one of those employees responded to the email and disclosed their credentials. The investigation confirmed that there was unauthorized access to the account between April 21, and April 23, 2024, and that the activity was limited to that account and no other systems or networks were compromised.
The email account was reviewed to identify the types of information that were potentially viewed or stolen, and that process was completed on June 28, 2024. United of Omaha said the unauthorized third party did not email any data from the account, but it could not rule out unauthorized access to emails and attachments.
The emails and attachments contained information related to United of Omaha’s group insurance products, and while it was not possible to determine the exact types of information exposed per individual, they likely included full names, demographic information including addresses and dates of birth, driver’s license numbers, health insurance policy numbers, Social Security numbers, employment information, and limited health information.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
While there does not appear to have been any data theft, the affected individuals have been offered 12 months of complimentary identity theft protection services. United of Omaha has also provided additional education to the workforce on how to identify and report phishing attempts.
