Phishing Attack Compromises Health First Patients’ Data

A non-profit community based health system in Florida, known as Health First, fall prey to a phishing attack. A notification was sent to around 42,000 patients, as they fear of potential compromise of their patients' data which consists of personal information, reports Florida Today. The non-profit community based health system comprises of four hospitals located in Brevard County.

Email accounts of quite a few Health First employees were hacked by the phishing scams, thus exposing some personal information of patients that was present in those compromised email accounts. The investigation regarding the breach further revealed that the access to the email accounts of the employees was first gained by the attackers in the month of February this year. These email accounts were being used for conducting more phishing attacks on various other employees of Health First till May 2018. It was only in the month of October that this breach has been reported to the Department of Health and Human Services.

Senior Vice President in Consumer and Retail Services, Health First, Matthew Gerrell, stated to Florida Today that, "based on a forensic review, it is believed that a limited number of emails were viewed, and the criminals did not appear interested in obtaining personal data, but focused on continuing their phishing scam". However, the hacked email accounts were contained with confidential health information of the patients, and thus they were sent notification of the data breach.

The hack gave cybercriminals access to some email accounts for a limited time period, and compromises those patients' personal information. It was revealed that the breach did not expose any financial or medical information, but the information of some customers' like birthdates, social security numbers and addresses may have been exposed and accessed by the unauthorized user.

As soon as the cyberattacks incidents were discovered, Health First officials said they immediately blocked access to impacted accounts and also changed the email account passwords of affected employees'. Since then, new improvised security measures were also implemented by Health First.

However, the Health First officials did not reveal when they first came to know about the attack, and they also did not disclose as to why they reported the breach so late to the Department of Health and Human Services.

» SPAMfighter News - 11/22/2018