Educators Mutual Insurance Association

Summary

Educators Mutual Insurance Association experienced a cybersecurity incident involving unauthorized network access over several weeks, leading to potential exposure of members' protected health information. The breach was detected after malware installation, compromising data including names, addresses, dates of birth, clinical details, health insurance identifiers, driver’s license numbers, and Social Security numbers, though financial data remained unaffected. A forensic investigation by external cybersecurity experts is ongoing, with no current evidence of data misuse identified. The organization has enhanced network monitoring and auditing protocols while advising affected individuals to remain vigilant against identity theft risks.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Educators Mutual Insurance Association (EMIA) based in Murray, UT, identified unauthorized access to its computer network spanning July 29, 2021, to August 10, 2021. The breach was detected by EMIA on August 23, 2021, prompting an internal investigation that confirmed the installation of malware on its network. A forensic review of the compromised systems revealed that files containing protected health information were potentially accessed or exfiltrated during the intrusion period. These files held sensitive member data including names, addresses, dates of birth, clinical information, health insurance identification numbers, driver’s license numbers, and Social Security numbers. EMIA clarified that full financial account numbers were not believed to have been exposed in the incident. The organization engaged a third-party cybersecurity firm to assist with the forensic investigation, which remained ongoing at the time of public disclosure.

EMIA’s investigation found no evidence of attempted or actual misuse of the compromised patient data. Affected individuals were advised to monitor their accounts and remain vigilant against potential identity theft. The organization committed to implementing enhanced network monitoring tools and conducting regular system audits to detect unauthorized activity. While EMIA did not disclose the total number of affected individuals or confirm regulatory reporting to entities such as the HHS Office for Civil Rights, it emphasized continuous efforts to strengthen its cybersecurity posture. The breach timeline, attacker methods beyond malware installation, and specific containment measures taken between detection and investigation phases were not detailed in available reports.

Sources

Sources available to members: 1 source.