United of Omaha Life Insurance Company based in Nebraska has reported a phishing email that led to a protected health information (PHI) breach involving 107,894 individuals. The insurer discovered the breach on April 23, 2024 upon identification of anomalous activity in the email account of an employee. United of Omaha noticed a third party’s unauthorized access to the account and blocked the account access by altering the Microsoft account passwords of the employee and by reporting and blocking the domain connected with the phishing attack.
The forensic investigation affirmed that access was acquired to the email account after a phishing campaign sent to employees solicited an employee’s response and exposed their credentials. The investigation showed unauthorized access to the email account from April 21 to April 23, 2024. The activity was confined to that account and the breach did not affect other systems or networks.
The email account was analyzed to determine the types of information that were possibly accessed or stolen. The analysis was finished on June 28, 2024. United of Omaha stated the unauthorized third party failed to email any information from the account, however, unauthorized access to emails and attachments cannot be ruled out.
The emails and attachments included data associated with the products offered by United of Omaha’s group insurance. Though it wasn’t possible to know the actual types of data breached per person, they likely included complete names, demographic data such as addresses and birth dates, medical insurance policy numbers, employment data, Social Security numbers, driver’s license numbers, and limited health data. After the completion of its investigation, data breach notification letters were sent to all individuals whose data was impacted by the data breach.
Although there seems to be no improper use of the stolen data, the impacted persons were provided one year of free identity theft protection services. United of Omaha has likewise provided further training to the employees on cybersecurity particularly recognizing and reporting phishing attacks, which is also required in HIPAA certification.
