Network Health, a Wisconsin-based insurer, has contact 51,232 of its plan members to advise them that some of their protected health information (PHI) hmay have been obtained by unauthorized persons.
Last August, a number of Network Health staff members received sophisticated phishing emails. Two of those members of staff replied to the scam correspondence and handed over their login credentials to the cyber attackers, who used those credentials to obtain access to their email accounts.
The compromised email accounts contained a lot of of private protected information including names, phone numbers, addresses, dates of birth, ID numbers and provider details. However, there was no financial information or Social Security numbers among the compromised accounts, although certain subscribers’ health insurance claim numbers and claim details was potentially obtained.
Thanks to the breach being detected rapidly, the hacked accounts were shut down to limit the damage caused. An external cybersecurity consultant was contracted in to review the extent of the attack and perform a forensic analysis to determine whether access to other parts of the network had been obtained. A report of the attacked was also made to law enforcement agencies who are also investigating the breach.
“As a result of this attack, steps are underway to further improve the security of operations and prevent future incidents” according to Penny Ransom, Network Health’s Chief Administrative Officer.
Those reactive steps include re-training the workforce to help employees identify and report phishing correspondence. A complete review of security procedures is also being conducted. All subscribers affected by the cyber attack have been offered 12 months of credit monitoring and identity theft protection services for free.
Network Health was just one of three healthcare providers to file a report on phishing attacks during September. Morehead Memorial Hospital was subjected to phishing attack that could have resulted in the exposure of 66,000 patients’ private data. Arkansas Oral & Facial Surgery Center experienced a phishing attack that saw ransomware installed. That cyber attack possible affected 128,000 people.
