Spokane Regional Health District (SRHD) based in Washington experienced once more a phishing attack. It is the second time this 2022, that the health district has publicized the potential exposure of patient information because a worker responded to a phishing email.
SRHD announced on March 24, 2022 that its IT section found a breached email account. The investigation lately affirmed that a staff replied to a phishing email last February 24, 2022, and later exposed information that permitted the account to be viewed. A week ago, SRHD reported that the email account comprised the protected health information (PHI) of 1,260 people. An unauthorized person may have ‘previewed’ that content, though there was no information received that indicates the viewing or downloading of information.
Data in the account contained names, birth dates, service dates, source of recommendation, provider hospital name, diagnosing condition, whether or not the patient was located, date placed, patient risk level, staging level, how drugs were gathered, test type, test outcome, treatment data, medication details, delivery dates and any treatment options given to the baby, diagnostic details, medical data, and client records.
An SRHD representative stated corrective steps were undertaken to mitigate the present situation and avert more phishing attacks, such as reinforcing staff cybersecurity training, employing multifactor authentication, and conducting testing on its systems.
Just like the majority of the state of Washington, SRHD has suffered a record-level increase in phishing emails and also malware installation efforts. In this case, employees became victims of a phishing scam that exposed sensitive facts to data thieves. SRHD Deputy Administrative Officer Lola Phillips mentioned their strong determination to secure personal data and to lessen the probability of future cyberattacks.
On January 24, 2022, SRHD reported the breach of a worker’s email account on December 21, 2021. The email account included the sensitive records of 1,058 persons, which include names, dates of birth, names of counselors, case numbers, test data and schedules of urinalysis, prescription drugs, and date of most recent dose.
Following that attack, SRHD mentioned it will be improving worker cybersecurity training, using multifactor authentication, and conducting tests on its systems.
Central Minnesota Mental Health Center Reports Email Account Breach
Central Minnesota Mental Health Center (CMMHC) has lately begun informing patients about the unauthorized access of a few of its email accounts. On October 21, 2021, CMMHC discovered possibly malicious activity inside its email environment. CMMHC performed a password reset to avoid more unauthorized access and engaged a third-party forensics firm to look into the nature and extent of the security breach.
On or approximately November 23, 2021, CMMHC found out that several email accounts were synched, and the attackers likely obtained emails in the accounts. The investigation confirmed the attackers acquired access to the email accounts from September 20, 2021 to October 29, 2021.
An evaluation of the impacted email accounts showed they included clinical data, patient account number, mailing addresses, treatment site, physician’s name and treatment/procedure details. In less usual circumstances, the emails included names, phone numbers, birth dates, Social Security numbers, and, in certain cases, credit card/financial account numbers and/or driver’s license numbers.
Supplemental safeguards and security procedures had been enforced to improve the privacy and security of data in its systems and impacted people received notification and offers of free identity protection and credit monitoring services.
CMMHC submitted the breach report to the HHS’ Office for Civil Rights indicating that 28,725 people were affected.