Jefferson Healthcare breach possibly affects 2,550 people

Phishing attack hits employee email, not medical, financial records

PORT‌ ‌TOWNSEND — Some 2,550 people may have had personal information taken during a phishing attack on a ‌‌Jefferson‌ ‌Healthcare‌ hospital employee’s email account, according to a hospital spokesperson.

All have been notified.

The attack, which occurred on Nov. 12, did not get into any systems outside the email account, said Amy Yaley, Jefferson Healthcare marketing and communications director, in an email released late Monday.

‌ “At‌ ‌this‌ ‌time,‌ ‌Jefferson‌ ‌Healthcare‌ ‌has‌ ‌a‌ ‌reasonable‌ ‌basis‌ ‌to‌ ‌believe‌ ‌that‌ ‌there‌ ‌has‌ ‌not‌ ‌been‌ ‌any‌ ‌improper‌ ‌access‌ ‌to‌ ‌its‌ electronic‌ ‌medical‌ ‌record‌ ‌system,‌ ‌billing‌ ‌systems,‌ ‌or‌ ‌other‌ ‌systems‌ ‌outside‌ ‌of‌ ‌the‌ ‌affected‌ ‌email‌ ‌account,‌ ‌or‌ ‌that‌ ‌the‌ ‌incident‌ ‌has‌ ‌affected‌ ‌or‌ ‌will‌ ‌affect‌ ‌any‌ ‌patient‌ ‌care,” Yaley’s email said.‌ ‌

Most information was not especially sensitive, but in 84 cases, Social Security numbers or financial information may have been disclosed, she said Tuesday.

‌Jefferson‌ ‌Healthcare‌ ‌has‌ ‌arranged‌ ‌for‌ ‌those people ‌to‌ ‌enroll‌ ‌in‌ ‌a‌ ‌credit‌ ‌monitoring‌ ‌service‌ ‌through‌ ‌Experian‌ ‌at‌ ‌no‌ ‌cost‌ ‌to‌ ‌the‌ ‌individuals, she added.

“Affected‌ ‌individuals‌ ‌should‌ ‌take‌ ‌steps‌ ‌to‌ ‌protect‌ ‌their‌ ‌identity‌ ‌and‌ ‌monitor‌ ‌their‌ ‌credit‌ ‌file,” Yaley said.

The employee whose email account had been attacked responded to what appeared to be a DocuSign document. Then she noticed emails were sent from her address to other people in her address books, Yaley said.

Jefferson Healthcare quickly contacted those 658 people to tell them not to open the document, Yaley said.

At same time, the hospital’s IT crew checked to see if the phishers had penetrated the firewall.

“They did not breach the firewall,” Yaley said, adding that the phishers did not get to financial records.

The computer was taken offline as soon as the breach was discovered. The phishers were in the system for about three days, Yaley said.

The hospital ‌hired‌ ‌two‌ ‌forensic‌ ‌specialist‌ ‌companies‌ ‌to‌ ‌determine‌ ‌the‌ ‌nature‌ ‌and‌ ‌extent‌ ‌of‌ ‌the‌ ‌ unauthorized‌ ‌access‌ ‌and‌ ‌email‌ ‌breach‌ ‌and‌ ‌to‌ ‌determine‌ ‌if‌ ‌personal‌ ‌information‌ ‌was‌ ‌involved, Yaley said.‌ ‌ ‌

The investigators combed through 30,000 .pdf documents and attachments to find everyone who might have been affected. They finished their work in the week between Christmas and New Year’s, Yaley said, and those who were found were sent notice on Monday.

“Based‌ ‌on‌ ‌Jefferson‌ ‌Healthcare’s‌ ‌security‌ ‌practices‌ ‌and‌ ‌investigation‌ ‌of‌ ‌the‌ ‌incident,‌ ‌it‌ ‌is‌ ‌reasonably‌ ‌believed‌ ‌that relatively‌ ‌few‌ ‌documents‌ ‌were‌ ‌likely‌ ‌viewed‌ ‌by‌ ‌the‌ ‌unauthorized‌ ‌parties‌ ‌during‌ ‌their‌ ‌brief‌ ‌access‌ ‌to‌ ‌the‌ ‌affected‌ ‌email account,” she added.

“However,‌ ‌the‌ ‌investigation‌ ‌could‌ ‌not‌ ‌definitively‌ ‌conclude‌ ‌that‌ ‌the‌ ‌unauthorized‌ ‌parties‌ ‌did‌ ‌not‌ ‌access‌ ‌certain information‌ ‌and‌ ‌documents‌ ‌stored‌ ‌in‌ ‌the‌ ‌affected‌ ‌email‌ ‌account.”

Other potentially‌ ‌exposed‌ ‌information‌ included an individual’s‌ ‌full‌ ‌name,‌ ‌date‌ ‌of‌ ‌birth,‌ ‌phone‌ ‌number,‌ ‌home‌ ‌address,‌ ‌health‌ ‌insurance‌ ‌information,‌ ‌certain‌ ‌health‌ information‌ ‌such‌ ‌as‌ ‌dates‌ ‌of‌ ‌service,‌ ‌and‌ ‌diagnosis‌ ‌and‌ ‌treatment‌ ‌information.‌

Yasley also said Jefferson Healthcare has taken preventative measures such as adding ‌anti-fraud‌ ‌technology‌ ‌safeguards‌ ‌and‌ ‌other‌ ‌cybersecurity‌ ‌risk‌ ‌prevention‌ ‌measures; reinforcing‌ ‌education‌ ‌and‌ ‌training‌ ‌for‌ ‌its‌ ‌staff‌ ‌members‌ ‌on‌ ‌how‌ ‌to‌ ‌avoid‌ ‌email‌ ‌phishing‌ ‌schemes‌ ‌and‌ ‌how‌ ‌to‌ ‌properly‌ ‌secure‌ ‌login‌ ‌credentials; and reviewing‌ ‌its‌ ‌policies‌ ‌and‌ ‌procedures‌ ‌to‌ ‌ensure‌ ‌they‌ ‌sufficiently‌ ‌protect‌ ‌against‌ ‌more such ‌incidents.

“Jefferson‌ ‌Healthcare‌ ‌takes‌ ‌individual‌ ‌privacy,‌ ‌and‌ ‌the‌ ‌trust‌ ‌of‌ ‌our‌ ‌community,‌ ‌seriously‌ ‌and‌ ‌has‌ ‌taken‌ ‌immediate‌ ‌steps‌ ‌to‌ ‌enhance‌ ‌our‌ ‌information‌ ‌security‌ ‌systems,” said‌ ‌Brandie‌ ‌Manuel,‌ ‌chief‌ patient‌ safety‌ ‌and‌ quality‌ ‌officer.

“We‌ ‌continue‌ ‌to‌ ‌be‌ ‌vigilant‌ ‌resolving‌ ‌security‌ ‌threats‌ ‌as‌ ‌they‌ ‌are‌ ‌identified‌ ‌and‌ ‌educating‌ ‌our‌ ‌staff‌ ‌members. ‌We‌ ‌are‌ ‌committed‌ ‌to‌ ‌transparency‌ ‌and‌ ‌sincerely‌ ‌apologize‌ ‌to‌ ‌those‌ ‌who‌ ‌have‌ ‌been‌ ‌impacted‌ ‌by‌ ‌this‌ ‌breach.”‌ ‌

It is not known who beached the computer.

“These things (phishing emails) look good. They are very sophisticated,” Yaley said. “All of us are going to have to continue to be more and more aware of what’s out there.

“They are after any information they can get.”


Executive Editor Leah Leach can be reached at 360-417-3530 or at [email protected].

More in News

Coast Guard searches for missing man west of Port Angeles

75-year-old man on 14-foot skiff boat

A contract has been awarded for safety improvements on a section of South Lincoln Street between Front and Eighth streets in Port Angeles. (Keith Thorpe/Peninsula Daily News)
Port Angeles City Council awards contract for Lincoln Street upgrade

Changes intended to improve safety in main corridor

Keith Thorpe/Peninsula Daily News
Crews work on Thursday to dismantle the loading dock at the site of the former Rayonier pulp mill in Port Angeles. Workers began removing about 800 concrete dock panels this week as a step toward dismantling the 6-acre pier at the former Rayonier property 2 miles east of downtown Port Angeles. The target date for completion is July, while more than 5,000 creosote-treated pilings will not be taken out at least until 2023 as part of the overall environmental cleanup of the 75-acre former industrial site's uplands and adjacent harbor waters, a process overseen by the state Department of Ecology and paid for by property owner Rayonier Advanced Materials.
Dock dismantle begins at Rayonier site in Port Angeles

Peninsula Daily News Crews work on Thursday to dismantle the loading dock… Continue reading

Rock show, open house set Saturday

The Clallam County Gem and Mineral Association will host an… Continue reading

Clallam County returns to state’s high-risk category

COVID-19 cases up by three on Peninsula

Most Read