Washington University School of Medicine

Washington University School of Medicine, also known as Washington University Medical School, is a prominent academic medical institution headquartered in the United States. Its core mission involves medical education, patient care, and biomedical research, forming the foundation of its activities within the healthcare sector. The institution operates within a complex environment handling sensitive personal health information and research data integral to its operations. This necessitates stringent adherence to privacy and security regulations governing protected health information and research participant confidentiality.

The organization experienced a significant cybersecurity incident on March 4, 2022. Unauthorized actors gained access to certain employee email accounts, potentially compromising sensitive information pertaining to patients and research participants. The compromised accounts contained a range of personal and protected data, including names, dates of birth, addresses, medical records, patient account numbers, clinical details, and, in limited instances, health insurance information or Social Security numbers. Forensic analysis conducted after the breach could not definitively confirm whether the intruders viewed or exfiltrated emails or attachments within the accessed accounts.

This breach impacted 1,056 individuals whose information was present in the affected email accounts. In response to the incident, Washington University School of Medicine took corrective actions focused on bolstering its defenses against similar future events. These actions included implementing enhanced email security protocols and reinforcing mandatory employee training programs specifically designed to improve the recognition of suspicious communications and phishing attempts. The incident underscores the persistent cybersecurity challenges faced by large academic medical centers managing vast quantities of highly sensitive personal and health-related data.