Revere Health, the largest independent multispecialty physician group in Utah, has recently revealed that an employee was targeted by a phishing operation. The company released a notification regarding a security breach involving patients of the Heart of Dixie Cardiology Department.
What Happened?
On June 21st, the email account of one of the physician group’s employees was breached for about 45 minutes which exposed some medical records of patients of the Heart of Dixie cardiology department in St. George, Utah.
After a two-month investigation, Revere Health concluded that around 12,000 patients were affected by the breach and had their medical record numbers, birth dates, provider names, procedures, and insurance provider names exposed, but not leaked online.
Bob Freeze, director of marketing and communications for Revere Health, doesn’t think it was the attacker’s intent to release patients’ medical information but rather a way to launch more sophisticated phishing email attacks on other Revere employees.
The company has contacted the impacted patients about the situation and advised them to keep an eye out if any of their medical information has been shared. According to Freeze, no financial information such as credit card information was exposed.
What Is A Phishing Attack?
As thoroughly detailed in our phishing guide, these attacks are a common way for hackers to gain access to sensitive records and information. Usually, phishing attacks look like legitimate emails from trustworthy companies and they ask people to open an attachment, often a link to a webpage, and once that attachment is accessed malware could be installed to steal data.
If a phishing attack is successful, it means that threat actors managed to exfiltrate private data. The stolen information is then used to commit financial or identity theft. Hackers also leverage it to gain unauthorized access to the victim’s accounts and create an opportunity to blackmail them for various benefits.
Revere Health revealed it will now send test phishing emails to its employees to prevent more attacks. If they click on the test emails, they will have to undergo awareness training from the group’s IT department.