DataBreaches.Net

Menu
  • About
  • Breach Notification Laws
  • Privacy Policy
  • Transparency Report
Menu

CO: Mercy Regional Medical Center patient records breached

Posted on April 29, 2014 by Dissent

Chase Olivarius-McAlister reports:

Centura Health – the nonprofit umbrella that owns Mercy Regional Medical Center – has sent letters to about 1,000 people in Durango warning that hackers may have gained access to their personal information.

The potentially compromised information includes patients’ name, Social Security number, Medicare beneficiary number, address, date of birth and phone number as well as clinical information, such as a patient’s diagnosis, date of service, the name of a patient’s treating physician and medical-record numbers.

According to a news release circulated by Centura Health, the hackers may have breached patients’ private information through a sophisticated “phishing” email attack that targeted Centura health employees.

Read more on Durango Herald.

A statement on the medical center’s website, dated April 22, reads:

Notice to our Patients Regarding “Phishing” Incident
04/22/2014

Centura Health takes our role of safeguarding patients’ information very seriously. This notice is to inform our patients of a recent incident that may have involved patient information and the actions we took.

On February 11, 2014 Centura Health experienced a “phishing” attack where outside attackers attempted to acquire employee usernames and passwords by posing as a trustworthy source by e-mail. A small group of Centura Health employees responded to the e-mails thinking they were legitimate requests. When we learned of this, we were able to immediately stop the attack and began an investigation. On February 21, 2014 we became aware that a small number of employee e-mail accounts may have been accessible as a result of the phishing. We hired an outside forensics expert firm to perform a comprehensive review of the affected employees’ e-mail accounts and confirmed that some of the e-mails contained patient information and may have included patient demographic information (e.g., name, address, date of birth, telephone number) and/or clinical information (e.g., medical record number, date of service, treating physician, diagnosis), and in some instances Medicare Beneficiary number and Social Security number.

There is no evidence that the information in the emails was ever viewed or used in any way. However, as a precaution, Centura Health began mailing letters to potentially affected patients on April 22, 2014. This incident did not affect all Centura Health patients. We have established a dedicated call center to assist patients with any questions and it will go live on April 22 at 6:00 p.m. Mountain Time. If you believe you have been affected, but have not received a letter by May 12, 2014, please call 1-800-964-1042 Monday through Friday between 7:00 a.m. and 7:00 p.m. Mountain Time.

Centura Health took immediate steps to implement and/or reinforce necessary protective measures to help prevent similar events in the future. Those steps included immediately stopping the attack, performing an investigation and hiring an outside forensics expert to assist, reinforcing education to all employees regarding “phishing” e-mails, and continuing to implement enhancements for strengthening user login authentication. Centura Health has also notified the appropriate authorities.

We deeply regret any inconvenience this may cause our patients.

Category: Uncategorized

Post navigation

← Boston Medical Center fires vendor after data breach
Alleged ‘Anonymous’ Computer Hacker Charged with 18 Counts of Cyberstalking →

Now more than ever

"Stand with Ukraine:" above raised hands. The illustration is in blue and yellow, the colors of Ukraine's flag.

Search

Browse by Categories

Recent Posts

  • AT&T gets preliminary approval for $177 million data breach settlement
  • Aflac notifies SEC of breach suspected to be work of Scattered Spider
  • Former JBLM soldier pleads guilty to attempting to share military secrets with China
  • No, the 16 billion credentials leak is not a new data breach — a wake-up call about fake news
  • Tonga’s health system hit by cyberattack (1)
  • Russia Expert Falls Prey to Elite Hackers Disguised as US Officials
  • Proposed class action settlement in In re Netgain Technology litigation
  • Qilin Offers “Call a lawyer” Button For Affiliates Attempting To Extort Ransoms From Victims Who Won’t Pay
  • Ireland’s Data Protection Commission publishes 2024 Annual Report
  • The headlines suggested Freedman Healthcare suffered a ransomware attack that affected patient data. The reality was quite different.

No, You Can’t Buy a Post or an Interview

This site does not accept sponsored posts or link-back arrangements. Inquiries about either are ignored.

And despite what some trolls may try to claim: DataBreaches has never accepted even one dime to interview or report on anyone. Nor will DataBreaches ever pay anyone for data or to interview them.

Want to Get Our RSS Feed?

Grab it here:

https://databreaches.net/feed/

RSS Recent Posts on PogoWasRight.org

  • Privacy in the Big Sky State: Montana’s Consumer Privacy Law Gets Amended
  • UK Passes Data Use and Access Regulation Bill
  • Officials defend Liberal bill that would force hospitals, banks, hotels to hand over data
  • US Judge Invalidates Biden Rule Protecting Privacy for Abortions
  • DOJ’s Data Security Program: Key Compliance Considerations for Impacted Entities
  • 23andMe fined £2.31 million for failing to protect UK users’ genetic data
  • DOJ Seeks More Time on Tower Dumps

Have a News Tip?

Email: Tips[at]DataBreaches.net

Signal: +1 516-776-7756

Contact Me

Email: info[at]databreaches.net

Mastodon: Infosec.Exchange/@PogoWasRight

Signal: +1 516-776-7756

DMCA Concern: dmca[at]databreaches.net
© 2009 – 2025 DataBreaches.net and DataBreaches LLC. All rights reserved.