DataBreaches.Net

Menu
  • About
  • Breach Notification Laws
  • Privacy Policy
  • Transparency Report
Menu

CO: Mercy Regional Medical Center patient records breached

Posted on April 29, 2014 by Dissent

Chase Olivarius-McAlister reports:

Centura Health – the nonprofit umbrella that owns Mercy Regional Medical Center – has sent letters to about 1,000 people in Durango warning that hackers may have gained access to their personal information.

The potentially compromised information includes patients’ name, Social Security number, Medicare beneficiary number, address, date of birth and phone number as well as clinical information, such as a patient’s diagnosis, date of service, the name of a patient’s treating physician and medical-record numbers.

According to a news release circulated by Centura Health, the hackers may have breached patients’ private information through a sophisticated “phishing” email attack that targeted Centura health employees.

Read more on Durango Herald.

A statement on the medical center’s website, dated April 22, reads:

Notice to our Patients Regarding “Phishing” Incident
04/22/2014

Centura Health takes our role of safeguarding patients’ information very seriously. This notice is to inform our patients of a recent incident that may have involved patient information and the actions we took.

On February 11, 2014 Centura Health experienced a “phishing” attack where outside attackers attempted to acquire employee usernames and passwords by posing as a trustworthy source by e-mail. A small group of Centura Health employees responded to the e-mails thinking they were legitimate requests. When we learned of this, we were able to immediately stop the attack and began an investigation. On February 21, 2014 we became aware that a small number of employee e-mail accounts may have been accessible as a result of the phishing. We hired an outside forensics expert firm to perform a comprehensive review of the affected employees’ e-mail accounts and confirmed that some of the e-mails contained patient information and may have included patient demographic information (e.g., name, address, date of birth, telephone number) and/or clinical information (e.g., medical record number, date of service, treating physician, diagnosis), and in some instances Medicare Beneficiary number and Social Security number.

There is no evidence that the information in the emails was ever viewed or used in any way. However, as a precaution, Centura Health began mailing letters to potentially affected patients on April 22, 2014. This incident did not affect all Centura Health patients. We have established a dedicated call center to assist patients with any questions and it will go live on April 22 at 6:00 p.m. Mountain Time. If you believe you have been affected, but have not received a letter by May 12, 2014, please call 1-800-964-1042 Monday through Friday between 7:00 a.m. and 7:00 p.m. Mountain Time.

Centura Health took immediate steps to implement and/or reinforce necessary protective measures to help prevent similar events in the future. Those steps included immediately stopping the attack, performing an investigation and hiring an outside forensics expert to assist, reinforcing education to all employees regarding “phishing” e-mails, and continuing to implement enhancements for strengthening user login authentication. Centura Health has also notified the appropriate authorities.

We deeply regret any inconvenience this may cause our patients.

Category: Uncategorized

Post navigation

← Boston Medical Center fires vendor after data breach
Alleged ‘Anonymous’ Computer Hacker Charged with 18 Counts of Cyberstalking →

Now more than ever

"Stand with Ukraine:" above raised hands. The illustration is in blue and yellow, the colors of Ukraine's flag.

Search

Browse by Categories

Recent Posts

  • North Shore University Sleep Disorders Center employee charged with secretly recording patients in restrooms
  • When ransomware listings create confusion as to who the victim was
  • Rajkot civic body’s GIS website hit by cyber attack, over 400 GB data feared stolen
  • Taiwan’s BitoPro hit by NT$345 million cryptocurrency hack
  • Texas gastroenterology and surgical practice victim of ransomware attack
  • Romanian Citizen Pleads Guilty to ‘Swatting’ Numerous Members of Congress, Churches, and Former U.S. President
  • North Dakota Enacts Financial Data Security and Data Breach Notification Requirements
  • Pro-Ukraine hacker group Black Owl poses ‘major threat’ to Russia, Kaspersky says
  • Vanta bug exposed customers’ data to other customers
  • Lyrix Ransomware Targets Windows Users with Advanced Evasion Techniques

No, You Can’t Buy a Post or an Interview

This site does not accept sponsored posts or link-back arrangements. Inquiries about either are ignored.

And despite what some trolls may try to claim: DataBreaches has never accepted even one dime to interview or report on anyone. Nor will DataBreaches ever pay anyone for data or to interview them.

Want to Get Our RSS Feed?

Grab it here:

https://databreaches.net/feed/

RSS Recent Posts on PogoWasRight.org

  • Florida ban on kids using social media likely unconstitutional, judge rules
  • State Data Minimization Laws Spark Compliance Uncertainty
  • Supreme Court Agrees to Clarify Emergency Situations Where Police Don’t Need Warrant
  • Stewart Baker vs. Orin Kerr on “The Digital Fourth Amendment”
  • Fears Grow Over ICE’s Reach Into Schools
  • Resource: HoganLovells Asia-Pacific Data, Privacy and Cybersecurity Guide 2025
  • She Got an Abortion. So A Texas Cop Used 83,000 Cameras to Track Her Down.

Have a News Tip?

Email: Tips[at]DataBreaches.net

Signal: +1 516-776-7756

Contact Me

Email: info[at]databreaches.net

Mastodon: Infosec.Exchange/@PogoWasRight

Signal: +1 516-776-7756

DMCA Concern: dmca[at]databreaches.net
© 2009 – 2025 DataBreaches.net and DataBreaches LLC. All rights reserved.