Cyber Incident Victim: Monroe County Hospital & Clinics
Date:
Feb 2020
Location:
United States of America
Summary
Monroe County Hospital & Clinics experienced a data breach compromising its business email system, potentially exposing the personal and health information of approximately 7,500 patients. The incident involved unauthorized access to internal communications where patient data may have been attached or referenced, though the electronic medical records system remained unaffected. Notifications were issued to affected individuals regarding the possible leakage of sensitive information through this email compromise.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On February 17, 2020, Monroe County Hospital & Clinics publicly disclosed a data breach impacting approximately 7,500 patients. The Iowa-based medical system confirmed unauthorized access to its business email system, which potentially exposed individuals' protected health information. While the organization clarified that its electronic medical records (EMR) system remained uncompromised, patient data was nevertheless jeopardized through attachments or references contained within internal business communications. The breach notification, issued via a news release, informed affected individuals that their personal information might have been accessed without authorization. Specific details regarding the breach timeline, intrusion methods, or duration of unauthorized access were not provided in the disclosure. The hospital did not specify the exact types of data exposed beyond referencing "individual health information" potentially present in emails.
The incident prompted Monroe County Hospital & Clinics to initiate formal notifications to all potentially impacted patients on the same date as the public announcement. While the compromise was confined to email accounts rather than clinical systems, the breach demonstrated how routine administrative communications could serve as vectors for health data exposure. No evidence suggested misuse of patient information at the time of disclosure, though the hospital did not elaborate on containment measures or forensic investigation findings. Patients were directed to the hospital's website for additional details through its official breach notice. The organization's public statement focused exclusively on confirming the event's occurrence, its scope, and the notification process without disclosing operational disruptions, remediation steps, or technical specifics of the compromise.