Cyber Incident Victim: University of North Carolina School of Medicine
Date:
Apr 2021
Location:
United States of America
Summary
An unauthorized individual potentially accessed a single faculty member's email account at the University of North Carolina School of Medicine, which also impacted affiliated hospitals due to the faculty's clinical role. The breach was confined to the targeted account, with no evidence of compromise to other systems. Exposed information included patient names, dates of birth, diagnosis and treatment details, and research study participation data, while health insurance details affected fewer than 30 individuals and Social Security numbers fewer than 10. The institution secured the account, initiated an investigation with cybersecurity experts, and notified impacted patients following a review of the account's contents.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On May 20, 2021, the University of North Carolina at Chapel Hill School of Medicine (SOM) and University of North Carolina Hospitals discovered that an unauthorized individual potentially accessed a single SOM faculty member’s email account. The faculty member in question provided clinical services at UNC Hospitals. Upon detection, the organizations immediately secured the compromised email account and initiated an investigation with assistance from a cybersecurity firm. The investigation determined the unauthorized access occurred on April 20, 2021, and was confined exclusively to that faculty member’s account. No evidence indicated compromise of other SOM or UNC Hospitals email accounts or patient information systems. The breach timeline suggested a one-day intrusion with no further unauthorized activity detected beyond April 20.
A thorough review of the email account’s contents revealed messages and attachments containing patient information related to UNC Hospitals care. Exposed data included patient names, dates of birth, diagnosis details, and treatment information. Some records also referenced research studies patients participated in or were eligible for through UNC Hospitals/SOM. The analysis identified health insurance information for fewer than 30 patients and Social Security numbers for fewer than 10 individuals. SOM and UNC Hospitals proceeded to notify affected patients about the potential exposure of their information. The organizations maintained that the incident remained isolated to the single email account, with no broader system infiltration or additional data repositories impacted beyond the identified account’s contents.