Phishing Attack Impacts 11,350 Sinai Health System Patients

by | Dec 14, 2017

Two employees at Chicago’s Sinai Health System have had their email accounts compromised in a recent cyberattack.

Sinai Health System reports that the phishing attack happened on October 2, and that it was quickly discovered and mitigated. Access to the compromised accounts was possible only for a matter of hours. Cybersecurity consultants were called in to help with the investigation, and while the potential for PHI access cannot be eliminated, the risk faced by patients is believed to be minimal.

No proof has been uncovered to suggest any financial information was accessed, although an analysis of the email accounts showed a range of protected health information of 11,350 patients was includeed in the email accounts and could potentially have been accessed.

As a precaution against identity theft and fraud, patients affected by the breach have been offered identity theft protection and credit monitoring services free of charge for one year.

Phishing is the most serious cybersecurity threat faced by companies and groups, with the healthcare sector often targeted by cybercriminals.

A recent report from IronScales shows that between 90% and 95% of successful breaches are due to phishing. Research completed by anti-phishing vendor PhishMe similarly suggest more than 90% of data violations begin with a phishing email.

Even with multi-layered phishing security measures, some emails will make it through perimeter defenses and will be sent to end users’ inboxes. It is therefore important to provide security awareness training to staff. Not only will this training help to enhance the phishing email identification skills of employees and will help to stop costly data breaches, it is also a necessity for complying with HIPAA.

In its July Cybersecurity Update Bulletin, OCR reminded HIPAA-covered bodies of the importance of giving regular training to staff. The newsletter came after a glut of phishing incidents reported by healthcare suppliers. The past few weeks have several further data breaches arising due to phishing, underscoring the need for continuous training of healthcare staff.



Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.


Please enable JavaScript in your browser to complete this form.

Patrick Kennedy

Patrick Kennedy is a highly accomplished journalist and editor with nearly two decades of experience in the field. With expertise in writing and editing content, Patrick has made significant contributions to various publications and organizations. Over the course of his career, Patrick has successfully managed teams of writers, overseeing the production of high-quality content and ensuring its adherence to professional standards. His exceptional leadership skills, combined with his deep understanding of journalistic principles, have allowed him to create cohesive and engaging narratives that resonate with readers. A notable area of specialization for Patrick lies in compliance, particularly in relation to HIPAA (Health Insurance Portability and Accountability Act). He has authored numerous articles delving into the complexities of compliance and its implications for various industries. Patrick's comprehensive understanding of HIPAA regulations has positioned him as a go-to expert, sought after for his insights and expertise in this field. Patrick's bachelors degree is from the University of Limerick and his master's degree in journalism is from Dublin City University. You can contact Patrick through his LinkedIn profile:

Raise the level of HIPAA Awareness in your organization with Learner-Friendly, Comprehensive and Affordable HIPAA Training.

Comprehensive HIPAA Training

Used in 1000+ Healthcare Organizations and 100+ Universities

    Full Course - Immediate Access

    Privacy Policy