March 25, 2019 By David Bisson 2 min read

Unauthorized individuals compromised and potentially exposed more than 350,000 Oregonians’ protected health information (PHI) in a HIPAA breach.

On March 21, the Oregon Department of Human Services (DHS) publicly confirmed that it had suffered a phishing attack around the beginning of the year. In that incident, nine individual employees at the agency opened a phishing email and clicked on an attached malicious link. This action granted attackers access to these employees’ email accounts, along with approximately 2 million emails contained therein.

Upon learning of the attack, the government department closed off the threat actors’ unauthorized access. It also launched an investigation to determine what happened. As a result of this analysis, the Oregon DHS learned that those responsible for the phishing emails had the necessary privileges to view the PHI of more than 350,000 Oregonians, including their names, addresses, dates of birth, Social Security numbers and relevant DHS information. The agency filed a notification as a substitute notice of a breach under Oregon’s Identity Theft Protection Act.

As part of its ongoing investigation, the DHS said it will continue working to identify all individuals affected by the breach and offer them identity theft monitoring services.

Not the Only HIPAA Breach in Recent Memory

This HIPAA breach is just the latest in a long line of similar incidents targeting healthcare data. In February 2019, for instance, HIPAA Journal reported how UConn Health had begun notifying approximately 326,000 patients that a phishing attack might have exposed their PHI. A month prior, Health IT Security covered an attack involving the Colorado-based Critical Care, Pulmonary & Sleep Associates in which fraudsters potentially breached 23,000 patients’ personal health information. Those attacks followed separate incidents at UnityPoint Health and Health Equity, as reported by ClickOnDetroit, less than a year ago.

How to Protect Personal Data From Phishing Attacks

Security professionals can help protect sensitive data from phishers by taking a measured, systematic approach to defending their organization’s critical information. That strategy should begin with network monitoring for known threats and anomalous behavior before expanding to include data encryption, access controls and other security measures that help ensure HIPAA compliance.

Finally, security teams should invest in and conduct phishing simulations to better fortify the workforce against phishing attacks.

More from

How will the Merck settlement affect the insurance industry?

3 min read - A major shift in how cyber insurance works started with an attack on the pharmaceutical giant Merck. Or did it start somewhere else?In June 2017, the NotPetya incident hit some 40,000 Merck computers, destroying data and forcing a months-long recovery process. The attack affected thousands of multinational companies, including Mondelēz and Maersk. In total, the malware caused roughly $10 billion in damage.NotPetya malware exploited two Windows vulnerabilities: EternalBlue, a digital skeleton key leaked from the NSA, and Mimikatz, an exploit…

3 Strategies to overcome data security challenges in 2024

3 min read - There are over 17 billion internet-connected devices in the world — and experts expect that number will surge to almost 30 billion by 2030.This rapidly growing digital ecosystem makes it increasingly challenging to protect people’s privacy. Attackers only need to be right once to seize databases of personally identifiable information (PII), including payment card information, addresses, phone numbers and Social Security numbers.In addition to the ever-present cybersecurity threats, data security teams must consider the growing list of data compliance laws…

ICS CERT predictions for 2024: What you need to know

4 min read - As we work through the first quarter of 2024, various sectors are continuously adapting to increasingly complex cybersecurity threats. Sectors like healthcare, finance, energy and transportation are all regularly widening their digital infrastructure, resulting in larger attack surfaces and greater risk exposure.Kaspersky just released their ICS CERT Predictions for this year, outlining the key cybersecurity challenges industrial enterprises will face in the year ahead. The forecasts emphasize the persistent nature of ransomware threats, the increasing prevalence of cosmopolitical hacktivism, insights…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today