Beacon Health System, based in South Bend, Ind., has been the subject of a sophisticated phishing attack. Here are five key points on the attack.
1. Unauthorized individuals accessed Beacon employee email accounts, which potentially contained protected health information of some individuals and patients.
2. On March 25, Beacon discovered the unauthorized access of email accounts. Some accounts could have been accessed as early as November 2013. The last unauthorized access occurred on Jan. 26, 2015.
3. Beginning May 22, Beacon began informing affected individuals of the breach.
4. There is no evidence that any sensitive information was viewed or removed from the email accounts. Accessible information included Social Security numbers, date of birth, driver's license number, diagnosis, date of service and other medical information.
5. Beacon notified HHS and state regulators. The health system is also working with the FBI.