The medical payment billing service company MultiPlan had reported a breach of its email system. On January 27, 2021, suspicious activity was discovered in the email account of one employee. The action was right away undertaken to stop unauthorized access. The information on the worker’s email was modified.
MultiPlan without delay began an investigation to find out the nature and magnitude of the breach, with the help supplied by forensics specialists. The investigation affirmed that the principal goal of the attack was to reroute wire transfers from the buyers of MultiPlan going to pay invoices. The attacker used the breached email account to converse with those prospects about billing and to make an effort to redirect payments to their account.
Though the attackers did not seem to target protected health information (PHI), the breached email account was identified to consist of the PHI of 214,956 people. That record may have been read or acquired by the attacker between December 23, 2020 and January 27, 2021.
The types of details found in the account were full names, home addresses, email addresses, birth dates, healthcare service provider names, medical record numbers, date/cost of healthcare services, claim identifiers, health insurance ID numbers, Social Security numbers, member IDs, and group IDs.
MultiPlan has advised all affected persons and will be providing free two years of credit monitoring. Supplemental protocols and procedures have already been enforced to stop further email breaches later on.
Email Account Breach at Hawaii Independent Physicians Association
Hawaii Independent Physicians Association (HIPA) is informing 18,770 patients concerning a security incident that relate to the email account of a subcontractor.
HIPA determined on February 4, 2021 that an unauthorized individual acquired access to the email account. The covered entity immediately blocked external access to the account and required all HIPA users to alter their login credentials for their network and email accounts as a preventative measure. With the help of a third-party cybersecurity company, HIPA confirmed the breach was restricted to one email account which comprised the protected health information (PHI) of patients of its doctors.
The compromised account involved the following types of information: full names, home addresses, dates of birth, and data regarding the health and wellness of patients. There was no evidence of unauthorized data access discovered, nevertheless the likelihood that PHI was read or gotten cannot be ruled out.
The cybersecurity agency checking out the breach made advice to boost email security and HIPA is currently carrying out the proposed improvements.
