The Saint Francis Ministries health system announced that an unauthorized person gained access to the email account of an employee causing a likely exposure of patient data.
The health system identified the breach on December 19, 2019 upon identifying the suspicious activity in the employee’s email account. A third-party computer forensics agency looked into the breach and established on February 12, 2020 that there was unauthorized access of the email account from December 13, 2020 to December 20, 2019. It can’t be established whether the attacker had viewed emails that contain patient data or downloaded any email information, nevertheless, there were no reports acquired that indicate the improper use of any patient data.
An analysis of the impacted email accounts was concluded on March 24, 2020 which showed the potential breach of the following data: name, birth date, driver’s license number, state ID number, Social Security number, credit or debit card number, bank or financial account number, username and password, diagnosis, treatment data, prescription details, name of provider, Medicare/Medicaid number, medical record number, medical insurance details, and treatment cost data.
On April 12, Saint Francis Ministries began mailing breach notification letters to impacted persons. The health system additionally offered the impacted patients free credit monitoring and identity theft protection services and took action to strengthen email security to make sure that the same breaches will be averted later on.
Phishing Attack on Hartford Healthcare
Healthcare network Hartford Healthcare in Connecticut and Rhode Island encountered a phishing attack and announced it on April 13, 2020. The healthcare network identified the phishing attack on February 13, 2020 after identifying abnormal activity in two employees’ email accounts.
With the assistance of a third-party computer forensics firm, Hartford Healthcare established that the attackers gained access to the accounts between February 13 and February 14, 2020.
At least one email account had the protected health information (PHI) of some patients, including names, medical insurance data, medical record numbers, and other health-related records. The email accounts also contained the Social Security numbers of 23 patients.
Hartford Healthcare mentioned that the attack impacted 2,651 patients and notifications are being mailed right now. There were 23 people who got offers of two-year free credit monitoring and identity theft protection services due to the potential exposure of their Social Security numbers.
