60,000 Records got exposed in a Phishing Attack on EmCare

EmCare, the physician staffing company based in the Dallas city of Texas, has said that it suffered from a data breach, thus possibly impacting around 60,000 individuals, out of which around 31,000 were patients. On Apr. 19, 2019, the affected individuals were sent notification letters.

As per the officials, the Texas-based physician staffing company has just recently discovered that an unauthorized individual accessed email account of a number of EmCare employees. The unauthorized individual accessed these email accounts when several employees of EmCare has responded to the phishing emails, and then revealed their email credentials. However, it is still not clear from the breach notice of EmCare that when this breach has occurred and for how much time the attackers accessed those email accounts.

On Feb. 19, 2019, the breach has been discovered. An investigation has been launched with assistance of a third-party forensic security firm, in order to determine scope of this security incident. The officials determined that those compromised email accounts have information about the patients, employees, as well as contractors. The information that was saved in those email accounts and possibly accessed or copied by attackers include names, driver license numbers, date of births, demographic information, Social Security numbers, and clinical information.

12 months of free identity theft protection and credit monitoring services is offered by the Texas-based physician staffing company (i.e. EmCare) to the individuals whose driver license numbers or Social Security numbers were possibly compromised. However, the investigation didn't find any evidence that will suggest any employee or patient information has been accessed or exfiltrated by attackers, even though the possibility cannot be ruled out. Also, no reports were received that will suggest any employee or patient information has been misused till date.

EmCare has since responded to this breach by implementing more security measures in order to avoid a recurrence, which includes various "advanced IT solutions" as well as providing the employees with additional training on the email security.

The breach report that was submitted to Department of Health and Human Services' Office for Civil Rights indicates 31,236 patients have been impacted by this breach.

» SPAMfighter News - 5/14/2019