Cyber Incident Victim: Verity Health System
Date:
Oct 2022
Location:
United States of America
Summary
A vendor associated with Seton Medical Center experienced a phishing incident resulting in unauthorized access to two employee email accounts. The breach potentially exposed patient names and clinical information, though the medical center's notification did not specify the number of affected individuals or confirm if additional data types were compromised. This incident highlights vulnerabilities stemming from third-party vendor security practices within healthcare operations.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
Seton Medical Center in Harker Heights disclosed a phishing incident involving one of its vendors on October 14, 2022, through a news release issued late that Friday afternoon. The breach occurred when unauthorized individuals gained access to the email accounts of two employees working for the vendor. While the medical center did not specify the exact timeline of the compromise, it confirmed the incident resulted from a phishing attack targeting the vendor’s systems. The compromised email accounts contained patient names and clinical information, though the hospital did not quantify the number of affected individuals or provide granular details about the types of clinical data involved. Seton Medical Center emphasized the vendor’s role in the incident but did not publicly identify the vendor by name or describe the nature of its services. Hospital officials indicated they became aware of the breach through the vendor’s notification but did not disclose how long the unauthorized access persisted before detection.
The incident potentially exposed sensitive patient information, prompting Seton Medical Center to notify affected individuals and offer unspecified support services. The hospital’s news release did not confirm whether the exposed data included financial records, Social Security numbers, or other identifiers beyond names and clinical details. No evidence suggested the compromised information was misused beyond the initial unauthorized access, though the hospital acknowledged the possibility of data exposure. Seton Medical Center collaborated with the vendor to secure the affected email accounts and initiated an internal investigation to assess the breach’s scope. The hospital directed patients to contact its support channels for additional information but did not reference regulatory filings or law enforcement involvement in its public statement. KDH News reported the incident based on the hospital’s release, though no further technical details about the phishing mechanism or attacker attribution were disclosed.