My Health My Resources (MHMR) of Tarrant County in Fort Worth, TX suffered a phishing attack that resulted in the compromise of some employees’ email accounts. MHMR only detected the phishing attack on December 3, 2019 and initiated an investigation immediately. Based on the investigation results, unauthorized access to the email accounts happened some time between October 12 and October 14, 2019. The email accounts contained the following information: names, Social Security numbers, Driver’s license numbers, and some information on the services provided by MHMR.
The investigators cannot ascertain if the hackers viewed patient data. There is also no report received concerning the misuse of patient data. As a preventative measure, MHMR notified by mail all 6,524 people affected by the email breach and provided free credit monitoring and identity theft protection services to those whose driver’s license number or Social Security number were potentially compromised.
MHMR additionally gave further email security training to all employees and strengthened its email security controls and systems.
Phishing Attack at Reva
Medical transportation service provider, Reva, reported a phishing attack that potentially resulted in the unauthorized access of the PHI of close to 1,000 patients.
Reva noticed some suspicious activities in the email account of an employee on September 12, 2019. Immediate action was taken to secure the email account and to investigate the incident. The investigators found out that other employee email accounts were also compromised. The unauthorized email accounts access possibly happened between July 23, 2019 and September 13, 2019.
The compromised information held in the email accounts included the names of patients, dates of service, driver’s license numbers, travel insurance details, limited clinical information, passport numbers, and Social Security numbers of some patients.
Reva provided credit monitoring and identity theft protection services for free to patients whose driver’s license numbers or Social Security numbers were compromised. The impacted people were given mail notifications on January 22, 2019.
Reva upgraded its email security by using multi-factor authentication and providing additional security awareness training to employees.
