Phishing Attacks Reported by UNC Chapel Hill School of Medicine and Starling Physicians
University of North Carolina Chapel Hill School of Medicine has experienced a phishing attack in which the protected health information of 3,716 patients has potentially been accessed by unauthorized individuals.
An investigation by third-party forensics experts confirmed that several employee email accounts were compromised between May 17, 2018 and June 18, 2018. It is unclear when the security breach was first detected.
The types of information in emails and email attachments in the compromised accounts varied from patient to patient and may have included names, birth dates, demographic information, Social Security numbers, health insurance details, financial account information, and credit card numbers.
Affected individuals were notified about the breach on November 12, 2019. Patients whose Social Security numbers were potentially compromised have been offered complimentary credit monitoring and identity theft protection services.
3 Steps To HIPAA Compliance
Please see HIPAA Journal
- Step 1 : Download Checklist.
- Step 2 : Review Your Business.
- Step 3 : Get Compliant!
The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.
Multi-factor authentication has now been implemented and employees have been provided with further cybersecurity and phishing awareness training.
Three Email Accounts Compromised in Phishing Attack on Starling Physicians
The Connecticut physician group, Starling Physicians P.C. has announced that the personal and health information of certain patients has potentially been compromised in a phishing attack.
The attack occurred on February 8, 2019 and a third-party forensics firm was engaged to conduct an investigation into the breach and assess the nature on scope of the attack. Three employee email accounts were discovered to have been compromised.
Starling Physicians learned on September 12 that the compromised email accounts contained names, addresses, dates of birth, Social Security numbers, passport numbers, health insurance information, billing information, and medical information of certain patients. It is unclear when the phishing attack was discovered.
Notification letters were sent to affected patients on November 12, 2019. Patients whose Social Security number was potentially compromised have been offered complimentary credit monitoring and identity theft protection services.
The HHS’ Office for Civil Rights breach portal shows 977 patients have been affected by the breach.