UAB Medicine Phishing Attack Impacts 19,000 Patients
UAB Medicine is alerting patients about an August 7, 2019 phishing attack that resulted in the email accounts of several employees of UAB Medical Center in Birmingham, AL being accessed by the attackers.
Upon discovery of the breach, the passwords on affected email accounts were changed to prevent further unauthorized access and UAB Medicine engaged a leading cybersecurity firm to investigate the breach.
An analysis of the compromised email accounts revealed they contained the protected health information (PHI) of 19,557 patients, including names and one or more of the following data elements: Medical record number, date of birth, dates of service, location of service, diagnoses, and treatment information. A limited number of patients also had their Social Security number exposed.
UAB Medicine provides security awareness training to its workforce and has taught employees how to identify phishing emails. In this instance, despite that training, several employees responded to the emails and disclosed their email account credentials. Those credentials were used to gain access to email accounts and the payroll system. The health system said the email used in the attack was a fake business survey that appeared to have been sent internally from an executive’s email account.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The aim of the attack appears to have been to gain access to the payroll system to divert employees’ payroll deposits. The attack was detected and blocked before any payroll deposits were redirected. While it is possible that the attackers viewed/copied patient information, no evidence of unauthorized PHI access or data exfiltration was identified and there have been no reports of misuse of patients’ PHI.
Affected individuals have been advised to monitor their accounts and explanation of benefits statements for signs of fraudulent activity and have been offered 12 months’ subscription to credit monitoring and identity theft protection services at no cost. Steps are being taken to improve email security to prevent similar breaches from occurring in the future.
