Hacked Simon Eye Management Email Accounts Contained PHI of More than 144,000 Patients
Wilmington, DE-based Simon Eye Management has suffered a breach of its email environment and hackers potentially gained access to the protected health information of 144,373 patients.
Simon Eye identified suspicious activity in certain employee email accounts on or around June 8, 2021. Action was immediately taken to secure the accounts and prevent further unauthorized access, and an investigation was launched to determine the nature and scope of the breach. Assisted by third -party security experts, Simon Eye determined that unauthorized individuals gained access to employee email accounts between May 12 and May 18, 2021.
The incident was an attempted business email compromise (BEC) attack, where employee email accounts are compromised and used in a scam to trick employees into making fraudulent wire transfers, in this case through the manipulation of invoices. Simon Eye said none of the attackers’ attempts were successful.
While gaining access to patient data did not appear to be the goal of the attackers, the email accounts they were able to access did contain patients’ protected health information and it is possible PHI was viewed or obtained in the attack. Simon Eye found no evidence indicating any patient information was viewed or stolen, and there have been no reported cases of actual or attempted misuse of patient data as a result of the cyberattack.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
A comprehensive review was conducted to identify patients whose PHI was contained in emails and email attachments. The review confirmed the following types of patient data were present in the accounts: name, medical history, treatment/diagnosis information, health information, health insurance information, and insurance application and/or claims information. A subset of individuals also had their Social Security number, date of birth, and/or financial account information exposed.
Simon Eye has implemented additional data security protocols to enhance email security and is in the process of verifying the contact information of all affected patients. Notification letters will be mailed to those individuals in due course.
