Cyber Incident Victim: Southcentral Foundation
Date:
Oct 2016
Location:
United States of America
Summary
Southcentral Foundation experienced a cybersecurity incident where unauthorized access to two employee email accounts compromised protected health information of nearly 15,000 individuals. The breach exposed sensitive data including names, Social Security numbers, medical records, treatment details, family member information, and tribal identification documents. Following detection, the organization disabled the affected accounts and engaged external consultants for investigation. Impacted individuals were offered complimentary credit monitoring and identity theft protection services to mitigate potential risks arising from the exposure of their personal and health-related information.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Southcentral Foundation (SCF), an Alaska-based healthcare organization, detected unauthorized access to two employee email accounts containing protected health information in October 2016. The organization first identified a potential security incident on October 18, prompting an investigation with external consultants. Forensic analysis revealed that one email account had been compromised from October 17-18, while the second account was accessible to unauthorized parties from October 14-18. Both accounts were immediately disabled upon confirmation of the breach. The incident exposed sensitive data belonging to 14,719 patients and stakeholders referred to as customers-owners in SCF's notification.
The compromised email accounts contained extensive protected health information including full names, medical record numbers, dates of birth, addresses, and Social Security numbers. Additional exposed data encompassed Medicaid ID numbers, tribal identification documents, birth certificates, photographs, medical histories, provider names, treatment details, diagnosis information, dates of service, and family member relationships with contact information. SCF confirmed the breach resulted from external hacking of employee email credentials rather than a systemic network intrusion. The organization began notifying affected individuals in December 2016 and offered complimentary credit monitoring and identity theft protection services through AllClear ID. No evidence suggested actual misuse of the exposed data at the time of notification, though the breadth of compromised information created significant privacy risks for impacted individuals.