Last December, the Children's Mercy information security team detected unauthorized account access to two employee email accounts associated with a phishing email leading to a fake website, the patient care organization posted on its website at the time. Two additional employee email accounts were accessed by unauthorized persons later that month, and one more employee account feel victim to the scam in January.
Officials then determined that the mailbox accounts for four of the five affected employees were downloaded by unauthorized individuals, though at the time Children's Mercy said while it would be notifying patients, it was not aware of any misuse of patient information.
Recently, a Children's Mercy spokeswoman said in an email to The Star: "The hospital identified 63,049 individuals that were potentially affected, which includes a subset of patients. The information involved varied.”The spokeswoman’s email continued, per the report, “Because the email accounts had a large amount of data that had to be evaluated, we have notified individuals in groups as we progressed through the process. The hospital has taken and continues to take steps to protect against any further incidents. These steps have included the implementation of the additional technical control of multi-factor authentication."
Indeed, Children’s Mercy has established a call center and an informational webpage to provide answers to families who may have been affected. Additionally, Children’s Mercy is offering free identity theft protection to those families.
Broadly speaking, phishing attacks continue to plague the healthcare industry. A recent cybersecurity survey conducted by the Health Information and Management Systems Society (HIMSS) revealed that 64 percent of respondents who have experienced a security incident in the last year indicated that the initial point of compromise was via e-mail (e.g., phishing e-mail). Indeed, according to that report, the top threat actor was the online scam artist involved in activities such as phishing and spear phishing.
