Cancer Centers of America’s Western Regional Medical Center, located in Bullhead City, has revealed that a staff email account has been hacked following a phishing email attack.
The phishing email seems to have been broadcast from the staff email account of a Cancer Treatment Centers of America executive. The email appear to have employed used social engineering techniques to trick the employee into revealing login credentials to the account.
The hacker was able to access the account, but only for a short period of time as the incident was discovered by IT staff and the user’s account password was reset. However, during the period of time that the email account was accessible some messages containing patients’ protected health information (PHI) may have been visible.
Cancer Treatment Centers of America hired a computer forensics firm to help with the investigation. While it was not possible to identify which, if any, emails were seen, it was found that the compromised email account included the PHI of 41,948 clients.
The details in the emails were different from patient to patient and may have incorporated: Name, address, email address, date of birth, medical record number, treatment appointments, facility attended, physician name, type of cancer, and health insurance details. A small number of Social Security numbers were visible but the emails did not include any financial details.
Free credit auditing and identity theft protection services have been provided to all patients whose Social Security number was exposed. Cancer Treatment Centers of America has since supplied additional training to staff members to assist them identify suspicious emails.
The breach took place on May 2, 2018 and the CTCA Information Technology Department swiftly took measures to reset the account; however, the Cancer Treatment Centers of America online portal breach notice states that CTCA only became knowledgeable of the breach of PHI on September 26, 2018.
The breach was officially made known to the Department of Health and Human Services’ Office for Civil Rights (OCR) on November 26, 2018.