A phishing attack on the Medical College of Wisconsin’s email system has left the confidential information of about 9,500 patients compromised, the school said Friday.
The Medical College notified affected patients that their information was breached in the attack, which occurred between July 21-28. Those affected include patients of the Medical College, as well as Froedtert Health and Children’s Hospital of Wisconsin.
The compromised email accounts contained one or more of the following: names, home addresses, dates of birth, medical record numbers, health insurance information, dates of service, surgical information, diagnosis/condition and treatment information.
Social Security numbers and bank account information for a “very small number of patients” were also contained within the affected email accounts, the school said.
A small number of faculty and staff were affected by the “spear phishing attack,” an email scam targeting a specific individual, organization or business to obtain sensitive information, the Medical College said.
A computer forensic firm hired to investigate the attack could not definitively conclude if the breached information was actually accessed, viewed or downloaded by the user.
The Medical College said it is not aware of any reports of identity fraud, theft or improper use of the information as a result of the incident, but provided affected patients with best practices to protect their information. Credit monitoring and identity theft restoration services have been provided to those whose Social Security numbers were potentially compromised, the school said.
A dedicated toll-free response line has been set up by the college at (844) 666-7416, Monday through Friday, 8 a.m. to 8 p.m.
In September 2016, the Medical College reported a data security breach, in which the information of about 3,200 patients was compromised after an unauthorized third-party accessed an employee’s email account.
