Multiple Email Accounts Compromised in UC Health Phishing Attack
University of Cincinnati Health (UC Health) is investigating a security breach that saw the email accounts of multiple employees accessed by an unauthorized individual.
The attack occurred between July 6 and July 12, 2019 and involved ‘a limited number’ of employee email accounts. An analysis of the compromised email accounts revealed they contained patients’ names, birth dates, medical record numbers, and some clinical information.
A forensic analysis of UC Health email system was unable to establish whether the attackers opened or copied any emails or email attachments. UC Health is attempting to determine exactly which patients have been affected and notification letters will be sent “in the coming weeks.” UC Health announced the breach on its website on September 4, 2019.
UC Health will be enhancing email security and re-educating employees to help them identify phishing and other malicious emails.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The incident has not yet appeared on the HHS’ Office for Civil Rights website, so it is unknown how many patients have been affected.
Conway Regional Medical Center Phishing Attack Reported
Conway Regional Medical Center in Conway, AR has discovered patient information has been compromised in a recent phishing attack. The breach was detected when suspicious activity was observed in employee email accounts. The investigation confirmed the accounts had been subjected to unauthorized access as a result of employees responding to phishing emails.
The emails contained names, addresses, health insurance information, Social Security numbers, and a limited about of medical information. No evidence was found to suggest patient information was stolen or misused. The medical center is reviewing its security policies and procedures, which will be updated to reduce the risk of further data breaches.
The breach report submitted to the Department of Health and Human Services’ Office for Civil Rights shows 37,000 patients were affected by the incident.
