DataBreaches.Net

Menu
  • About
  • Breach Notification Laws
  • Privacy Policy
  • Transparency Report
Menu

CO: Mercy Regional Medical Center patient records breached

Posted on April 29, 2014 by Dissent

Chase Olivarius-McAlister reports:

Centura Health – the nonprofit umbrella that owns Mercy Regional Medical Center – has sent letters to about 1,000 people in Durango warning that hackers may have gained access to their personal information.

The potentially compromised information includes patients’ name, Social Security number, Medicare beneficiary number, address, date of birth and phone number as well as clinical information, such as a patient’s diagnosis, date of service, the name of a patient’s treating physician and medical-record numbers.

According to a news release circulated by Centura Health, the hackers may have breached patients’ private information through a sophisticated “phishing” email attack that targeted Centura health employees.

Read more on Durango Herald.

A statement on the medical center’s website, dated April 22, reads:

Notice to our Patients Regarding “Phishing” Incident
04/22/2014

Centura Health takes our role of safeguarding patients’ information very seriously. This notice is to inform our patients of a recent incident that may have involved patient information and the actions we took.

On February 11, 2014 Centura Health experienced a “phishing” attack where outside attackers attempted to acquire employee usernames and passwords by posing as a trustworthy source by e-mail. A small group of Centura Health employees responded to the e-mails thinking they were legitimate requests. When we learned of this, we were able to immediately stop the attack and began an investigation. On February 21, 2014 we became aware that a small number of employee e-mail accounts may have been accessible as a result of the phishing. We hired an outside forensics expert firm to perform a comprehensive review of the affected employees’ e-mail accounts and confirmed that some of the e-mails contained patient information and may have included patient demographic information (e.g., name, address, date of birth, telephone number) and/or clinical information (e.g., medical record number, date of service, treating physician, diagnosis), and in some instances Medicare Beneficiary number and Social Security number.

There is no evidence that the information in the emails was ever viewed or used in any way. However, as a precaution, Centura Health began mailing letters to potentially affected patients on April 22, 2014. This incident did not affect all Centura Health patients. We have established a dedicated call center to assist patients with any questions and it will go live on April 22 at 6:00 p.m. Mountain Time. If you believe you have been affected, but have not received a letter by May 12, 2014, please call 1-800-964-1042 Monday through Friday between 7:00 a.m. and 7:00 p.m. Mountain Time.

Centura Health took immediate steps to implement and/or reinforce necessary protective measures to help prevent similar events in the future. Those steps included immediately stopping the attack, performing an investigation and hiring an outside forensics expert to assist, reinforcing education to all employees regarding “phishing” e-mails, and continuing to implement enhancements for strengthening user login authentication. Centura Health has also notified the appropriate authorities.

We deeply regret any inconvenience this may cause our patients.


Related:

  • Maintenance Note
  • CISA Alert: Reported Supply Chain Compromise Affecting XZ Utils Data Compression Library, CVE-2024-3094
  • System Status Note
  • System Status Note
  • Fraudster's fake data breach claims should remind media to be careful what we report
  • "Pompompurin" taken into custody after violating conditions of pre-sentencing release on bond (1)
Category: Uncategorized

Post navigation

← Boston Medical Center fires vendor after data breach
Alleged ‘Anonymous’ Computer Hacker Charged with 18 Counts of Cyberstalking →

Now more than ever

"Stand with Ukraine:" above raised hands. The illustration is in blue and yellow, the colors of Ukraine's flag.

Search

Browse by Categories

Recent Posts

  • Scattered Spider Hijacks VMware ESXi to Deploy Ransomware on Critical U.S. Infrastructure
  • Hacker group “Silent Crow” claims responsibility for cyberattack on Russia’s Aeroflot
  • AIIMS ORBO Portal Vulnerability Exposing Sensitive Organ Donor Data Discovered by Researcher
  • Two Data Breaches in Three Years: McKenzie Health
  • Scattered Spider is running a VMware ESXi hacking spree
  • BreachForums — the one that went offline in April — reappears with a new founder/owner
  • Fans React After NASCAR Confirms Ransomware Breach
  • Allianz Life says ‘majority’ of customers’ personal data stolen in cyberattack (1)
  • Infinite Services notifying employees and patients of limited ransomware attack
  • The safe place for women to talk wasn’t so safe: hackers leak 13,000 user photos and IDs from the Tea app

No, You Can’t Buy a Post or an Interview

This site does not accept sponsored posts or link-back arrangements. Inquiries about either are ignored.

And despite what some trolls may try to claim: DataBreaches has never accepted even one dime to interview or report on anyone. Nor will DataBreaches ever pay anyone for data or to interview them.

Want to Get Our RSS Feed?

Grab it here:

https://databreaches.net/feed/

RSS Recent Posts on PogoWasRight.org

  • Congress tries to outlaw AI that jacks up prices based on what it knows about you
  • Microsoft’s controversial Recall feature is now blocked by Brave and AdGuard
  • Trump Administration Issues AI Action Plan and Series of AI Executive Orders
  • Indonesia asked to reassess data privacy terms in new U.S. trade deal
  • Meta Denies Tracking Menstrual Data in Flo Health Privacy Trial
  • Wikipedia seeks to shield contributors from UK law targeting online anonymity
  • British government reportedlu set to back down on secret iCloud backdoor after US pressure

Have a News Tip?

Email: Tips[at]DataBreaches.net

Signal: +1 516-776-7756

Contact Me

Email: info[at]databreaches.net

Mastodon: Infosec.Exchange/@PogoWasRight

Signal: +1 516-776-7756

DMCA Concern: dmca[at]databreaches.net
© 2009 – 2025 DataBreaches.net and DataBreaches LLC. All rights reserved.