Michigan Medicine Suffers Another Email Data Breach
University of Michigan Medicine (Michigan Medicine) has recently notified 56,953 individuals about the exposure of some of their protected health information. According to a recent news release, patient data was stored in three employee email accounts which were accessed by an unauthorized third party between May 23, and May 29, 2024.
When suspicious email activity was detected, the affected accounts were immediately secured to prevent further unauthorized access by blocking the attacker’s IP address and changing account passwords. An investigation was launched to determine the nature and scope of the breach which confirmed that the incident was limited to three employee email accounts.
Michigan Medicine conducted a review of the affected email accounts between June 10, 2024, and June 27, 2024, and confirmed that sensitive data was present in the accounts. The email accounts were used for communications related to payment and billing coordination. Michigan Medicine did not find any evidence to suggest the aim of the attack was to obtain patient information; however, data theft could not be ruled out.
The types of information exposed varied from individual to individual and included patient and insurance guarantor information including names, addresses, dates of birth, medical record numbers, diagnostic and treatment information, and health insurance information. Notification letters started to be mailed to the affected individuals on July 19, 2024. Credit monitoring services do not appear to have been offered; however, Michigan Medicine has advised all affected individuals to be vigilant against identity theft and fraud and recommends monitoring medical insurance statements for fraudulent activity.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Michigan Medicine was affected by the recent outage due to the faulty CrowdStrike update but confirmed that the data breach was unrelated to that incident. This is the second email breach at Michigan Medicine in the past 2 years. On October 25, 2022, Michigan Medicine notified the HHS’ Office for Civil Rights about a breach involving the protected health information of 33,857 individuals. Four email accounts were compromised between August 15 and August 23, 2022, as a result of a phishing attack.
