Health First Phishing Attack Impacts 42,000 Customers
Health First Inc., a four-hospital Florida-based health system, experienced a hacking/IT incident earlier this year that was reported to the Department of Health and Human Services’ Office for Civil Rights on October 5. According to the OCR breach summary, 42,000 customers were affected by the breach. Further information has now been released on the nature of the breach.
According to Health First, the email accounts of multiple employees were compromised in the phishing attack. The exposed protected health information was contained in the compromised email accounts. The electronic medical record system was unaffected by the attack.
An investigation into the breach revealed the attackers first gained access to employee email accounts in February 2018. Those email accounts were used to conduct further phishing attacks on other Health First employees until May 2018.
According to Health First, the attackers gained access to “a small number” of employee email accounts. The compromised email accounts contained a limited amount of protected health information such as names, addresses, and birth dates, although some individuals’ Social Security numbers were also exposed. No medical information or financial information was compromised.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
A forensic review was conducted to determine the nature of the breach and the individuals impacted. Based on that review, Health First does not believe the attackers were interested in viewing emails or obtaining protected health information. The attackers only appeared to be interested in compromising more email accounts to conduct further phishing scams. The review showed only a small number of emails were accessed by the attackers.
Upon discovery of the breach, Health First changed the passwords on all compromised email accounts to prevent any further access and new security measures have now been implemented.
All affected patients have been notified of the breach by mail and offered AllClear ID identity theft monitoring and repair services for 12 months without charge.
