Cyber Incident Victim: CCRM
Date:
Oct 2018
Location:
United States of America
Summary
A healthcare provider experienced unauthorized access to a former employee's email account by an unknown third party, potentially exposing patient information including names, addresses, email addresses, health details, insurance data, and medical history, with limited exposure of Social Security and driver's license numbers. The breach was detected after patients received spam emails from the compromised account, prompting immediate account deactivation and investigation. While no evidence confirmed actual viewing or misuse of the data, the organization notified affected individuals and established a dedicated call center for inquiries as part of enhanced security measures to prevent future incidents.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
On October 4, 2018, CCRM Dallas-Fort Worth discovered unauthorized access to a former nurse’s email account by an unknown third party. The breach was identified after patients received spam emails originating from the compromised account. The practice immediately engaged its IT vendor to deactivate the account and initiated an investigation to assess potential data exposure. The forensic analysis determined the intruder could have viewed or accessed patient information stored within the email account, including names, addresses, email addresses, health information, insurance details, and medical histories. For a limited subset of patients, Social Security numbers and driver’s license numbers were also potentially exposed. No evidence confirmed that unauthorized parties actually viewed or exfiltrated the data, and the practice found no indications of misuse related to the incident.
CCRM Dallas-Fort Worth mailed notification letters to affected individuals on December 3, 2018, detailing the incident’s scope and providing a dedicated toll-free call center (1-800-939-4170) operational Monday through Friday from 10 AM to 10 PM Central. The practice reiterated its commitment to patient privacy and stated it had implemented measures to prevent similar incidents, though specific technical or procedural changes were not disclosed. The notification emphasized that while sensitive data was potentially accessible during the breach window, no concrete evidence of unauthorized access or misuse had been identified. The incident involved no confirmed compromise of clinical systems beyond the single email account, and no ransomware or malware activity was reported in connection with the event.