HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

PHI of 521,000 Individuals Compromised in Security Breach at Morley Companies

Morley Companies, a Saignaw, MI-based provider of business services, has recently announced it was the victim of a cyberattack that started on August 1, 2021, that prevented access to data in its information systems.

Rapid action was taken to isolate the affected systems and a leading cybersecurity firm was engaged to investigate and determine the nature and scope of the security incident. In addition to encrypting data on its systems, the attackers exfiltrated certain data from its systems.

A comprehensive review was conducted of all files on its systems that could have been accessed by the attackers, and Morley Companies then started collecting contact information for those individuals to allow notification letters to be sent. Morley Companies said that process was completed in early 2022, and notification letters started to be sent to affected individuals on February 1, 2022.

The forensic investigation confirmed the following types of information were potentially accessed and/or stolen in the cyberattack: Names, addresses, Social Security numbers, birthdates, client identification numbers, medical diagnostic and treatment information, and health insurance information.

Get The Checklist

Free and Immediate Download
of HIPAA Compliance Checklist

Delivered via email so verify your email address is correct.

Your Privacy Respected

HIPAA Journal Privacy Policy

Morley Companies said it has reviewed its data security safeguards and has now made alterations to its cyber environment to prevent similar attacks in the future. Affected individuals have been offered a complimentary membership to credit monitoring and identity theft protection services.

The security breach has been reported to law enforcement and the Department of Health and Human Services’ Office for Civil Rights (OCR). The OCR data breach portal indicates the protected health information of 521,046 individuals was potentially compromised.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.