Cyber Incident Victim: Metropolitan Jewish Health System
Date:
Jan 2016
Location:
United States of America
Summary
Metropolitan Jewish Health System experienced a phishing incident where employees were deceived into disclosing credentials, leading to unauthorized access to email accounts containing sensitive member and patient information. The compromised data included names, addresses, dates of birth, Social Security numbers, and medical details. The organization secured affected accounts, conducted an investigation, and implemented enhanced security measures such as employee retraining and strengthened login protocols to mitigate future risks.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In February and March 2016, unauthorized individuals gained access to employee email accounts at Metropolitan Jewish Health System (MJHS) and its affiliated agencies. The breach occurred between February 18 and March 4, 2016, with the organization discovering suspicious email account activity on March 4. MJHS initiated an investigation that confirmed the compromise of multiple employee email accounts during this period. The compromised accounts contained protected health information and personally identifiable information of MJHS members and patients. Exposed data included full names, physical addresses, dates of birth, Social Security numbers, health insurance policy details, and medical record information. The attackers used phishing techniques to obtain employee credentials, though the specific phishing method wasn't disclosed. MJHS did not report evidence of actual misuse or attempted misuse of the stolen information. The incident potentially affected both current and former patients across MJHS's network of healthcare services.
MJHS began mailing notification letters to impacted individuals following the completion of their internal investigation. The organization offered affected parties complimentary credit monitoring and identity theft protection services through a third-party provider. As part of their response, MJHS implemented additional security measures including enhanced login authentication protocols for employee email accounts. The healthcare provider conducted mandatory retraining for all staff on identifying and preventing phishing attempts. No ransomware deployment or system encryption was reported in connection with the incident. MJHS did not disclose whether law enforcement was notified or the total number of affected individuals. The organization's public statement emphasized ongoing efforts to strengthen information security practices across its network of healthcare providers and affiliated programs.