Cyber Incident Victim: Saint Agnes Medical Center
Date:
May 2016
Location:
United States of America
Summary
Saint Agnes Medical Center reported that a phishing email attack resulted in the theft of W-2 forms for approximately 2,800 employees, raising concerns about potential identity theft. The hospital said the breach did not compromise its internal systems or patient information, and that the state Attorney General’s office and the FBI are investigating. To help those affected, the hospital is offering a free one‑year membership to an identity‑theft monitoring service.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On May 5, 2016, ABC30 reported that thousands of employees at Saint Agnes Medical Center were facing the possibility of identity theft following a security breach. The breach involved the unauthorized acquisition of W-2 tax forms belonging to every employee of the hospital. According to the hospital, the incident affected approximately 2,800 staff members. The hospital stated that the information was obtained through an email phishing attack.
The Office of the Attorney General and the Federal Bureau of Investigation were notified and began investigating the criminal activity. Hospital officials emphasized that the breach did not compromise any of the medical center's internal systems. They specifically noted that no patient information was accessed, altered, or put at risk as a result of the incident. The hospital described the event as a local incident limited to employee data.
To support those affected, Saint Agnes Medical Center offered a free one‑year membership to an identity theft monitoring service. The hospital indicated that this service would help employees detect and respond to any potential misuse of their personal information. No further details about the phishing email or the attackers were disclosed in the report. The statement concluded with the hospital’s commitment to cooperate with ongoing investigations.