St. Louis-based Washington University School of Medicine began notifying 14,795 oncology patients March 31 of a phishing attack.
In January, the medical school discovered than an unauthorized person had gained access to the email account of the oncology division supervisor. It's unclear if the unauthorized person was able to view any emails or attachments in the email account.
Patient data that may have been exposed included names, dates of birth, medical record or patient account numbers and limited treatment or clinical information. A limited amount of Social Security numbers and health insurance information may have also been affected.
Washington University School of Medicine has reinforced education with staff on avoiding suspicious emails and are making additional security enhancements to prevent a similar incident from happening again.