Children’s Hospital of Philadelphia (CHOP) has announced that the email accounts of two employees have been compromised following cyberattacks on two August 23 and August 29, 2018.
On August 24, CHOP, a paediatric healthcare facility and primary care provider, discovered an unauthorized individual had gained access to the email account of one of the physicians working at the facility. An investigation was launched into the incident, and it was revealed the account was first accessed the previous day.
Investigators determined that the access was obtained through a successful phishing attack on the physician’s email account. Healthcare information has a huge black market value, making healthcare facilities a potentially lucrative target for cybercriminals. Recent years have seen a massive increase in the risk that cyberattacks such as phishing pose to healthcare industries. Phishing attacks have grown in sophistication in recent years, and often hospitals don’t have the budget to build robust infrastructures to protect their systems against the attacks, or even lack the resources to train their staff about the dangers of phishing.
Two weeks later after the first breach was discovered, on September 6, CHOP discovered a second email account had also been compromised. This time, it was determined that access to the account was first gained on August 29. In both cases, prompt action was taken to secure the accounts and prevent further access. A leading computer forensics firm was also brought in to assist with the investigation and assess the scope of the breach.
An analysis of the email accounts revealed the cybercriminals behind the phishing attacks may have been able to gain access to the protected health information (PHI) of a limited number of patients of CHOP’s neonatal and fetal programs. The information that was exposed differs from patient to patient and may have included a full name, birth date, and clinical information related to neonatal/fetal services received at Children’s Hospital of Philadelphia and, in a limited number of cases, the Hospital of the University of Philadelphia. Investigators determined that the attackers did not gain access to Social Security numbers or financial information were compromised at any point.
While emails in the account were potentially accessed and ePHI may have been stolen, CHOP and its collaborators state that there is no evidence that patient information has been used maliciously since the breach was discovered. In accordance with HIPAA’s Breach Notification Rule, mothers and parents/legal guardians of current and former patients were notified of the breach by mail on October 23, 2018. Affected individuals have been advised to monitor statements from their healthcare providers for any signs of fraudulent activity.
CHOP has not yet disclosed how many individuals have been affected. The phishing incidents have yet to appear on the Department of Health and Human Services’ Office for Civil Rights breach portal.
“While CHOP is not aware of any actual or attempted misuse of patient information related to these incidents, on October 23, 2018, letters were mailed to patient families whose information was contained in these email accounts,” the hospital informed patients and families. “Potentially affected patients are advised to carefully review the statements they receive from their healthcare providers. If they see services that were not received, they should contact their healthcare provider immediately.”
Following the twin attacks on their organisation, CHOP is taking action to significantly improve the safeguards in place on their security system.
