Email accounts that contain the protected health information (PHI) of patients were exposed at Welfare, Pension and Annuity Funds of Local No. ONE, I.A.T.S.E. and Signature Healthcare Brockton Hospital.
Welfare, Pension, and Annuity Funds of Local No. ONE, I.A.T.S.E
Welfare, Pension, and Annuity Funds of Local No. ONE, I.A.T.S.E has lately informed 20,579 persons regarding the exposure of sensitive information in an email security incident. The provider noticed suspicious activity in a worker’s email account on December 21, 2021 and secured the account immediately to block unauthorized access. A forensic investigation was performed to find out the nature and extent of the breach.
On October 25, 2021, the investigation confirmed that the email account had been accessed by an unauthorized person from May 11, 2021 to August 2, 2021, because the employee responded to a phishing email. After a manual audit of the emails and file attachments, it was confirmed that they included these types of data:
Names, birth dates, government ID numbers, financial account data, Social Security numbers, and medical data that possibly includes medical provider data, diagnostic and conditions details, treatment and medication data, medical ID number(s), and/or medical insurance plan details. I.A.T.S.E Local ONE stated it did not find any evidence of sensitive information misuse.
After the breach, I.A.T.S.E Local ONE sought the help of its IT managed services provider to enforce additional security procedures so as to strengthen email security to stop other data breaches.
Signature Healthcare Brockton Hospital
Signature Healthcare based in Massachusetts has lately reported a data breach that has impacted 9,798 patients of Brockton Hospital. Suspicious activity had been discovered in its email system on November 4, 2021. The investigators of the incident confirmed that unauthorized individuals had accessed the email accounts of a number of doctors between October 16, 2021 and November 4, 2021.
A prominent forensic security company investigated the breach and stated that its computer programs and network remained secure. Signature Healthcare mentioned that it seemed there was no access of email accounts nor exfiltration of patient data. There was also no proof that show the misuse of any PHI; nonetheless, unauthorized PHI access cannot be excluded.
The breached email accounts held these types of data: First and last names, birthdates, sex, dates of appointments, test data, medical record numbers, diagnoses, and medical backgrounds. Signature Healthcare is going over its technical settings and processes and will take the appropriate steps to strengthen security to avoid other breaches later on.