Cyber Incident Victim: Manitowoc County
Date:
Jan 2018
Location:
United States of America
Summary
A phishing attack compromised a Manitowoc County email account, exposing protected health information including names, addresses, health insurance details, and medical records through unauthorized email diversions to an external account. The county detected the breach months later, secured affected systems, and notified impacted individuals, though no evidence of data misuse was identified. Officials warned of potential follow-up phishing attempts mimicking legitimate communications following the incident.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 2 techniques |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On or around January 14, 2018, an unauthorized party gained access to a Manitowoc County email account through a suspected phishing attack. The breach allowed the diversion of emails containing protected health information to a non-county account. Compromised data included individuals' names, addresses, health insurance details, and medical records. County officials remained unaware of the intrusion until April 24, 2018, when they discovered the unauthorized access and immediately secured affected systems. Forensic investigation confirmed the breach duration spanned approximately three months between initial compromise and detection. No evidence indicated misuse of the exposed personal or medical information during or after the incident period.
Manitowoc County publicly disclosed details of the breach through a June 22, 2018 press release following internal investigation. The county issued formal notifications to individuals whose protected health information was exposed in the compromised email account. Officials advised vigilance against potential phishing scams mimicking official county communications in the breach's aftermath. Corporation Counsel Peter Conrad served as the designated contact point for public inquiries at 888-811-5636. The county directed additional information seekers to review the full press release on its official website at www.co.manitowoc.wi.us. Response measures included system security reinforcement and breach notification procedures compliant with health information privacy regulations.