American Osteopathic Association Notifies 27,500 Individuals About June 2020 Data Theft Incident
Approximately 27,500 individuals are being notified that some of their personal information was stolen in a cyberattack on the American Osteopathic Association (AOA). AOA is a Chicago-based professional organization that represents around 151,000 osteopathic physicians and medical students across the United States.
On June 25, 2020, the AOA identified suspicious activity within some of its systems. Its network was taken offline, and forensic investigators were engaged to determine the nature and scope of the incident. The investigation confirmed the attackers gained access to systems that contained personally identifiable information and exfiltrated data from those systems.
A comprehensive review of the files was conducted to determine which individuals had been affected. That review determined names, addresses, dates of birth, Social Security numbers, financial account information, and email addresses/usernames and passwords were in the exfiltrated data.
The AOA said its investigation did not uncover any evidence of actual or attempted misuse of the stolen data, but as a precaution against identity theft and fraud, affected individuals have been offered complimentary credit monitoring and identity theft protection services for 12 months.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
It has taken more than 15 months from the discovery of the breach for affected individuals to be notified. The AOA said that like many organizations, the COVID-19 pandemic presented considerable challenges to its normal business operations. As a result of the pandemic, it took considerably longer for AOA to identify the names and addresses of the affected individuals. According to the AOA, this was “due to the pandemic’s impact on our staff’s working conditions, and their inability to be on location to identify all potentially impacted parties.” It took until June 1, 2021, for the total population of affected individuals and contact information to be identified.
According to the breach report submitted to the Maine Attorney General, notifications were sent to affected individuals on October 13, 2021.
