HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

Phishing Scam Fools University of Vermont Medical Center Employees into Revealing Login Credentials

A phishing campaign targeting University of Vermont Medical Center (UVMC) has resulted in criminals gaining access to UVMC email accounts. The phishing emails were sent in late May and two employees responded. Doing so allowed the attackers to temporarily gain access to their email accounts. The phishing emails were part of a large campaign sent to many UVMC employees. Fortunately, only two individuals responded. The emails appeared to have been sent from within the organization.

The accounts were compromised on May 22, and on May 24 UVMC detected spam emails being sent from the accounts and shut them down to minimise the damage caused.

The electronic medical record system was not compromised, although the email accounts did contain protected health information (PHI) such as names, medical record numbers, addresses, details of medications, medical diagnoses and treatment information.  No Social Security numbers, insurance information or financial data were compromised.

It is possible that the purpose of the attack was not to gain access to PHI, only to use the email accounts to send spam emails. The spam emails included links to external websites. UVM Health Network’s Head of Internet Security, Heather Roszkowski, suggests the attack may have been conducted to boost traffic to those websites to increase advertising income.

No reports have been received to suggest any information was accessed and misused in any way. However, all affected individuals should exercise caution and monitor their accounts and Explanation of Benefits statements for any sign of fraudulent activity.

All patients impacted by the attack have now been notified of the incident by mail and a substitute breach notice has been uploaded to the UVMC website. That notice indicates approximately 2,300 patients were impacted.

UVMC says that it already has robust security measures in place to prevent attacks such as this, although it will be reviewing those measures to determine whether improvements can be made. UVMC will also be reinforcing training to reduce the probability of employees falling for this type of phishing scam again.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.