49,351 Patients Impacts in Alomere Health Phishing Attack

Alexandria, MN-based Alomere Health is contacting around 50,000 patients to inform them that some of their protected health information may have been accessed by unauthorized individuals due to a phishing attack.

Alomere Health first noticed the phishing attack on November 6, 2019 and kicked off an internal investigation which confirmed the account was accessed by an unauthorized individual frp, October 31 and November 1, 2019.

A computer forensics group was brought in to help out with the investigation and discovered on November 10, 2019 that a second email account had been violated on November 6.

A complete review of the compromised accounts showed that a number of emails and email attachments held protected health information. The range of information potentially compromised in the attack was different  from patient to patient and may have included the following data elements: Names, addresses, dates of birth, medical record numbers, health insurance information, treatment information, and/or diagnosis details. A small number of Social Security numbers and driver’s license numbers were also located in the accounts.

Alomere Health has now implemented additional more layers to its cyber security and more further security awareness HIPAA training has been provided to employees to help them identify phishing emails and other email-based dangers.

Alomere Health was unable to find out if any emails or email attachments including protected health information were accessed or copied by the hackers, but unauthorized PHI access and data theft could not be eliminated. On January 3, 2020, Alomere Health sent notifications to all 49,351 patients whose information was seen in the email accounts.

Individuals whose Social Security number or driver’s license number were obtained have been provided with free credit monitoring and identity theft protection services for one year. No reports of misuse of patient information have been registered so far.