Two employees at Chicago’s Sinai Health System have had their email accounts compromised in a recent cyberattack.
Sinai Health System reports that the phishing attack happened on October 2, and that it was quickly discovered and mitigated. Access to the compromised accounts was possible only for a matter of hours. Cybersecurity consultants were called in to help with the investigation, and while the potential for PHI access cannot be eliminated, the risk faced by patients is believed to be minimal.
No proof has been uncovered to suggest any financial information was accessed, although an analysis of the email accounts showed a range of protected health information of 11,350 patients was includeed in the email accounts and could potentially have been accessed.
As a precaution against identity theft and fraud, patients affected by the breach have been offered identity theft protection and credit monitoring services free of charge for one year.
Phishing is the most serious cybersecurity threat faced by companies and groups, with the healthcare sector often targeted by cybercriminals.
A recent report from IronScales shows that between 90% and 95% of successful breaches are due to phishing. Research completed by anti-phishing vendor PhishMe similarly suggest more than 90% of data violations begin with a phishing email.
Even with multi-layered phishing security measures, some emails will make it through perimeter defenses and will be sent to end users’ inboxes. It is therefore important to provide security awareness training to staff. Not only will this training help to enhance the phishing email identification skills of employees and will help to stop costly data breaches, it is also a necessity for complying with HIPAA.
In its July Cybersecurity Update Bulletin, OCR reminded HIPAA-covered bodies of the importance of giving regular training to staff. The newsletter came after a glut of phishing incidents reported by healthcare suppliers. The past few weeks have several further data breaches arising due to phishing, underscoring the need for continuous training of healthcare staff.