Michigan Medicine notifies nearly 57K patients after health information potentially exposed in cyberattack
(CBS DETROIT) - Michigan Medicine notified approximately 56,953 people about a data breach that impacted employee email accounts and possibly exposed patient health information.
Officials on Monday said three Michigan Medicine employee email accounts were breached on May 23 and May 29 due to a cyberattack unrelated to the recent CrowdStrike outage.
After discovering the breach, the attacker's IP address was blocked, and immediate password changes were made.
Michigan Medicine couldn't find any evidence that the cyberattack's goal was to gain access to patient health information, "but data theft could not be ruled out."
Due to this, the contents of all emails involved were reviewed between June 10 and June 27.
Officials found that some emails and attachments had " identifiable patient and/or insurance guarantor information," including names, medical record numbers, addresses, dates of birth, diagnostic and treatment information, and/or health insurance information.
The emails that included this information were communications about payment and billing for patients. No credit card, debit card or bank account numbers were included in the emails, but four patients were notified separately since their Social Security numbers.
"Michigan Medicine immediately took steps to investigate this matter, once alerted to the possibility of patient data being exposed. We constantly monitor for cyberattacks such as these because patient privacy is so extremely important to us," said Jeanne Strickland, Michigan Medicine's chief compliance officer. "We currently have multiple safeguards in place to reduce risk to our patients and prevent recurrence but will examine this incident thoroughly to determine if new or additional measures are needed."
Patients who were affected were mailed notices starting on July 19.
Anyone with questions or concerns can call the Michigan Medicine Assistance Line at 1-888-409-7484.
"While Michigan Medicine does not have reason to believe the accounts were compromised for the purpose of obtaining patient information, as a precautionary measure, all affected patients have been advised to monitor their medical insurance statements for any potential evidence of fraudulent transactions," Michigan Medicine said in a release.