Unauthorized individuals compromised and potentially exposed more than 350,000 Oregonians’ protected health information (PHI) in a HIPAA breach.

On March 21, the Oregon Department of Human Services (DHS) publicly confirmed that it had suffered a phishing attack around the beginning of the year. In that incident, nine individual employees at the agency opened a phishing email and clicked on an attached malicious link. This action granted attackers access to these employees’ email accounts, along with approximately 2 million emails contained therein.

Upon learning of the attack, the government department closed off the threat actors’ unauthorized access. It also launched an investigation to determine what happened. As a result of this analysis, the Oregon DHS learned that those responsible for the phishing emails had the necessary privileges to view the PHI of more than 350,000 Oregonians, including their names, addresses, dates of birth, Social Security numbers and relevant DHS information. The agency filed a notification as a substitute notice of a breach under Oregon’s Identity Theft Protection Act.

As part of its ongoing investigation, the DHS said it will continue working to identify all individuals affected by the breach and offer them identity theft monitoring services.

Not the Only HIPAA Breach in Recent Memory

This HIPAA breach is just the latest in a long line of similar incidents targeting healthcare data. In February 2019, for instance, HIPAA Journal reported how UConn Health had begun notifying approximately 326,000 patients that a phishing attack might have exposed their PHI. A month prior, Health IT Security covered an attack involving the Colorado-based Critical Care, Pulmonary & Sleep Associates in which fraudsters potentially breached 23,000 patients’ personal health information. Those attacks followed separate incidents at UnityPoint Health and Health Equity, as reported by ClickOnDetroit, less than a year ago.

How to Protect Personal Data From Phishing Attacks

Security professionals can help protect sensitive data from phishers by taking a measured, systematic approach to defending their organization’s critical information. That strategy should begin with network monitoring for known threats and anomalous behavior before expanding to include data encryption, access controls and other security measures that help ensure HIPAA compliance.

Finally, security teams should invest in and conduct phishing simulations to better fortify the workforce against phishing attacks.