After a successful phishing attack against a local public health agency, the sensitive medical data of over 1,200 Washington residents was exposed.
During the incident on February 24, 2022, an attacker may have “previewed” the “files containing client protected health information” associated with 1,260 persons and two departments, according to Spokane Regional Health District (SRHD).
In a data breach alert released on March 24, SRHD said that, “the investigation did not find any documents had been opened, accessed, or downloaded”.
According to SRHD, 1,060 people’s first and last names, initials, dates of birth, and medical data may have been exposed. Test results, medications and prescription reasons, medical referrals, client notes, and delivery dates for pregnancies, were among the health-related information that may have been exposed.
According to SRHD, despite the fact that no Social Security numbers or financial information were involved, “those affected are encouraged to monitor their bank accounts and report any suspicious activity immediately”
The healthcare provider noted that potential victims had been alerted of the breach.
SRHD stated that it has “implemented appropriate corrective actions” to prevent future breaches, related to cybersecurity training, the implementation of Multi-Factor Authentication (MFA), and the testing related systems.
Lola Phillips, Deputy Administrative Officer at the SRHD, said “Much like the rest of the state of Washington, SRHD has experienced a record-level spike in phishing emails and malware installation attempts,”
“In this instance, staff fell prey to a phishing scam which exposed confidential information to data thieves.”
“We have a strong commitment to safeguard your personal information, and we are working diligently to reduce the likelihood of future events.”