Minnesota DHS reported another breach of 2018 from a phishing attack

The Minnesota Department of Human Services (DHS) found that another email account of an employee has been compromised due to a phishing attack. This latest incident was just been reported, even though the breach takes place before or on March 26, 2018.

In the month of June and July 2018 also, Minnesota DHS suffers from two phishing attacks that resulted in email accounts getting compromised. Both those phishing attacks have been announced in Oct. 2018, and have resulted in exposure of Protected Health Information (PHI) of 20,800 Minnesotans'. This March 2018 email account compromise exposed 10,263 Minnesotans PHI.

An employee email account of Direct care and Treatment Administration was accessed by the attacker in the March 2018 phishing attack. After accessing the account, emails were sent from that compromised email account to the co-workers requesting for wire transfers to be made. However, those email requests are flagged suspicious and are reported to the Minnesota IT Services (MNIT). MNIT then secured the account, and no wire transfers have been made.

During the time when compromised email account was being accessible, the attacker possibly accessed emails in that compromised account which included PHI. However, MNIT was not able to find whether any Protected Health Information had been copied or viewed. The compromised account contained information like names, dates of birth, contact information, legal histories, treatment data, as well as 2 Social Security numbers. Any reports of PHI misuse have not been received.

MNIT reported this March 2018 breach to FBI; whereas DHS notified Department of Health and Human Services' Office for Civil Rights, media, credit reporting agencies, the Legislative Auditor's Office, and the state senate along with house representatives on Apr. 9, 2019. Individual notices were also sent to everybody affected by this March 2018 breach.

Chuck Johnson, DHS Deputy Commissioner, said that "we're telling them that we regret that this happened, we're extremely sorry. We take this very seriously. We take all the control of all the data we have on people very seriously".

DHS said that MNIT has provided details of this breach investigation on Feb. 15, 2019. Once notified about this breach, a contractor was hired by DHS to assess contents of email account so as to check for PHI. As there are several emails in the compromised account, DHS says that the account review got completed on Mar. 21, 2019.

» SPAMfighter News - 5/2/2019