Cyber Incident Victim: United Regional Health Care System
Date:
Jul 2020
Location:
United States of America
Summary
United Regional Health Care System experienced a breach involving unauthorized access to an employee email account, potentially compromising patient information. The organization discovered the incident last July but only confirmed in December that sensitive data within the account could have been exposed, despite lacking direct evidence of actual access. The breach impacted fewer than 2,000 individuals, with notification letters sent to affected patients.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 1 motive | 1 technique |
| Threat Actors | Type | Location |
|---|---|---|
| 0 actors | Available to members | Available to members |
Description
In July 2020, United Regional Health Care System experienced a security incident involving unauthorized access to an employee email account. The organization did not immediately confirm the potential compromise of patient information during the initial discovery phase. By December 2020, investigators determined that protected health information could have been exposed through the breached email account, though no direct evidence confirmed actual access to or theft of patient data. The healthcare system initiated patient notification procedures following this determination, sending individual letters to affected parties. This notification occurred approximately six months after the initial intrusion was detected, indicating a prolonged investigation period to assess the breach's scope and implications. The organization maintained transparency about the lack of evidence regarding whether attackers specifically viewed or exfiltrated medical records or personal information contained within the email system.
United Regional Health Care System limited its public disclosures to direct patient communications and local media reports, with Texas news outlets confirming the incident impacted fewer than 2,000 individuals. The breach did not appear on the U.S. Department of Health and Human Services' public breach portal at the time of media reporting in February 2020, suggesting the organization either remained within the 60-day reporting window or qualified for an exemption due to the limited scale. No details emerged regarding specific types of data potentially exposed, security measures protecting the email account, or whether credential compromise enabled the unauthorized access. The healthcare system's response focused on notifying potentially affected patients without confirming any actual misuse of information stemming from the incident.