Cyber Incident Victim: Swedish Hospital
Date:
Mar 2021
Location:
United States of America
Summary
A Swedish Hospital physician's email account was compromised by a third party, enabling attackers to distribute spear-phishing emails to internal colleagues. The organization responded by deactivating the breached account, temporarily suspending remote email access, and initiating an independent forensic investigation. While security measures preventing downloads or prints of emails containing protected health information likely limited exposure, unauthorized access to personal data—including names, birthdates, contact details, and treatment-related information—occurred. The hospital assessed that exfiltrating patient health records was not the primary objective of the intrusion.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 0 motives | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On March 22, 2021, Swedish Hospital identified a security incident involving unauthorized access to a physician’s email account. A third party breached the account and used it to distribute spam and spear-phishing emails to other individuals within the organization, attempting to deceive colleagues into opening malicious messages. Upon discovery, Swedish Hospital promptly deactivated the compromised email account to halt further unauthorized activity. As an additional containment measure, the hospital temporarily suspended remote email access across its systems, limiting potential avenues for attackers to exploit other accounts or escalate the breach. The organization subsequently initiated an independent forensic analysis to investigate the scope of the intrusion, assess the attacker’s methods, and identify any additional vulnerabilities or compromised systems.
The hospital’s email system included safeguards preventing users from downloading or printing emails containing protected health information (PHI), which likely restricted the hackers’ ability to exfiltrate sensitive patient medical data. However, the attackers gained access to other types of information within the breached account, including patient and employee names, birthdates, contact details, and treatment-related information. Swedish Hospital stated in its May 28 news release that the evidence suggested the hackers’ primary objective was not to steal PHI but rather to leverage the compromised account for further phishing campaigns targeting internal personnel. Despite this assessment, the exposure of personal and treatment information created potential risks for affected individuals, including identity theft or secondary social engineering attacks. The incident underscored the vulnerability of email systems to credential compromise and the cascading threats posed by insider account takeovers.