Conifer Health Solutions

Summary

Conifer Health Solutions experienced unauthorized access to a Microsoft Office 365 business email account, discovered during an internal audit, compromising protected health information of 2,787 individuals. The breach exposed names, birth dates, addresses, financial account details, medical and treatment data, insurance information, billing records, and Social Security numbers. The company secured the account, implemented multifactor authentication and enhanced email monitoring, and offered affected individuals credit monitoring and identity protection services.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

Conifer Health Solutions, a Frisco, Texas-based provider of revenue cycle management and administrative services to healthcare organizations, identified unauthorized access to a single Microsoft Office 365 business email account during an internal audit. The breach was confirmed to have occurred on January 20, 2022, though discovery took place at an unspecified later date through routine auditing processes. Subsequent forensic analysis conducted between June 13 and August 3, 2022, determined the compromised account contained protected health information belonging to 2,787 individuals. Exposed data elements included full names, dates of birth, physical addresses, financial account details, medical treatment information, health insurance policy specifics, billing and claims records, and Social Security numbers. The investigation confirmed the breach was isolated to this single email account, which operated independently from Conifer's primary internal systems and corporate network infrastructure. No evidence suggested broader network penetration or compromise of additional accounts beyond this specific mailbox.

Upon confirming the breach, Conifer Health Solutions immediately implemented containment measures to prevent further unauthorized access to the affected email account. The company enhanced security protocols across its email environment, including the deployment of multifactor authentication and increased monitoring capabilities to detect anomalous access patterns. Notification letters were issued to all 2,787 impacted individuals, with specific offers of complimentary credit monitoring and identity theft protection services extended to those whose financial account details or Social Security numbers were exposed. Internal audits and security reviews were conducted to assess potential vulnerabilities, though no systemic weaknesses were publicly disclosed beyond the singular compromised account. The incident did not disrupt Conifer's operational services or client systems, as the breached email account remained functionally segregated from core business platforms throughout the event.

Sources

Sources available to members: 1 source.