PHI Stolen As a Result of Manitowoc County Phishing Attack
Manitowoc County in Wisconsin has announced protected health information has been stolen as a result of a successful phishing attack. The incident occurred on or around January 14, 2018, although the attack and data breach was not discovered until April 24. While the account was immediately secured to prevent any further access, the attacker had well over two months to view and obtain sensitive data stored in the email account.
During the time that the attacker had email account access, emails sent to that account were diverted to a different email account to which Manitowoc County staff had no access. While County officials have not uncovered any evidence to suggest any of the information in the emails has been misused, they have similarly not been able to establish that sensitive data have not been misused or sold on.
The types of information that were stolen include names, telephone numbers, email addresses, addresses, and dates of birth. Individuals who received services through the County have also had their health information, insurance information, details of prescriptions, client ID numbers, diagnoses, and other treatment related information stolen by the attacker.
Manitowoc County has not publicly disclosed how many individuals have been impacted and the incident has yet to be listed on the Department of Health and Human Services’ Office for Civil Right breach portal. However, Manitowoc County has now issued notifications to all individuals impacted by the phishing attack.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Breach victims have been warned that they should be alert to phishing emails that claim to be from Manitowoc County. County officials have confirmed that they will not send any emails or make calls to people impacted by this incident and request further personal information. Individuals impacted by the breach have also been told to be wary of any emails containing hyperlinks, to exercise caution opening any emails, and not to disclose sensitive information to individuals over the telephone.
The phishing attack has prompted the County to take further steps to enhance security controls and additional investments will be made in new protocols, technology and training to prevent further successful phishing attacks from occurring.
