Cyberattack Results in Data Breach at Regional Cancer Care Associates

Hackers continue to get access to healthcare employees’ email accounts, leading to breaches in personal health information. The most recent victim, Regional Cancer Care Associates (RCCA), sent a notice of a data privacy event last week to inform patients that hackers accessed certain personal and protected health information from employee email accounts.

RCCA became aware of suspicious activity from an unauthorized party on May 24. The cancer care center then investigated to confirm the security of its network and learn more about the event. With the help of third-party forensic investigators, RCCA learned that it was the victim of unauthorized access to several employee email accounts between April 17 and June 4.

On July 16, the group confirmed that certain personal and protected health information were in the email accounts that were accessed.

Inside Digital Health™ made several attempts to reach RCCA to learn more about how many patients were affected and the details of the attack, but those requests went unanswered.

Affected Personal Health Information

Although RCCA Group has no evidence that the hacker misused information found in the email accounts, the attackers could have access to the patients’:

• Name and date of birth
• Address
• Health information
• Treatment and diagnosis information
• Physician information
• Prescription information
• Health insurance information

And for a subset of patients, the following types of information were also included in the email accounts:

• Driver’s license number
• Social Security number
• Financial account number and/or payment card

What Is RCCA Doing About the Data Breach?

“We are keenly aware of how important personal information is to our patients and are strongly committed to our responsibility to protect all data entrusted to us,” the notice said. “We are continuously taking steps to enhance data security precautions.”

The login credentials for the affected email accounts were changed to prevent further unauthorized access.

The group is augmenting security controls and implementing additional controls, including the use of multi-factor authentication to prevent employee emails from unauthorized access.

Affected individuals will also have access to complimentary credit and identity monitoring and identity restoration services.

Protecting Health Data from Email Attacks

Phishing attempts have been prominent in healthcare and represent 93% of data breaches today, according to one report. Email phishing is the primary attack vector for nine out of 10 cyberattacks because it’s not readily detectable by traditional email security tools.

But there are ways to protect data from spoofing attacks.

Health systems should add more layers of security in the email mailbox. This security uses self-learning technology and detects attacks faster than the technology deployed at most hospitals.

It is also important to develop social media standards, because many employees involuntarily give away about 80% of the information needed to develop a spoofing attack.

And, of course, training is essential for health system employees, especially given the intricate and sensitive data being collected. Employees need to know what to be aware of how an attack can happen and the consequences of such attacks.

Get the best insights in digital health directly to your inbox.

Related

3 Trends Plaguing Healthcare Cybersecurity & How to Fight Them

Data Breach Affects 12M Quest Diagnostics Patients

Giving Data Security a Human Face to Regain Patient Trust