Naples, Fla.-based NCH Healthcare System began notifying patients Feb. 14 that their information may have been exposed in a phishing attack.
In June 2019, the health system noticed suspicious activity within its human resources, timekeeping and payroll system. Upon investigation, NCH determined that a limited number of employees had fallen victim to a phishing attack. By obtaining employees' credentials in the phishing attack, the unauthorized third party was able to access employees' payroll records.
NCH's patient record system was not affected in the data breach. NCH believes that the hacker only attempted to reroute direct deposit funds. There is no evidence that any emails were viewed, and there is no evidence that patient information has been misused.
Patient data found in the compromised email accounts that may have been exposed included names, dates of birth, driver's license numbers, tribal identification numbers, financial account information, payment card information, medical histories, treatment information, medication or prescription information, beneficiary information, provider information, patient identification numbers, health insurance information and username and password information. NCH estimates that less than 5 percent of patients had their Social Security numbers affected.
"The confidentiality, privacy and security of personal information in its care is one of NCH's highest priorities," said the health system in a statement. "Upon learning of the suspicious payroll activity, NCH immediately commenced an investigation and took steps to secure our system. NCH worked with third-party forensic investigators to confirm the full nature and scope of this event. While NCH has measures in place to protect information in its system, it is implementing additional safeguards to protect the security of information."