50,000 patients of Alexandria, MN-based Alomere Health are being contacted to advise them that a portion of their protected health information was potentially accessed by unauthorized people due to a phishing attack.
Alomere Health first became aware of out the phishing attack on November 6, 2019 and kicked off an internal investigation which confirmed the account was logged into by an unauthorized person between October 31 and November 1, 2019.
A computer forensics firm was hired to conduct an investigation and found that, on November 10 2019, another email account had been illegally accessed on November 6.
A thorough review of the impacted accounts found that some emails and email attachments contained protected health information. The range of data that may have been compromised in the attack was different from patient to patient and may have incorporated the following data elements: Names, addresses, dates of birth, medical record numbers, health insurance information, treatment information, and/or diagnosis information. A small amount of Social Security numbers and driver’s license numbers were also identified in the accounts.
Alomere Health was unable to state outright if any emails or email attachments including protected health information were accessed or copied by the hackers, but unauthorized PHI access and data theft could not be eliminated. On January 3, 2020, Alomere Health sent alerts to all 49,351 patients whose data was present in the email accounts.
Those whose Social Security number or driver’s license number was accessible have been offered free credit monitoring and identity theft protection services for 12 months. No reports of misuse of patient information have been registered to date.
Alomere Health has now bolstered its cyber defenses and additional security awareness training has been given to employees to help them spot phishing emails and other email-based dangers.