The University recently announced the breach, which impacted a number of patients.
What happened
The University of Chicago Medical Center (UCMC) announced they experienced a data breach impacting approximately 10,332 individuals.
According to their posted notice, breached information may have included names, dates of birth, Social Security numbers, tax identification numbers, IRS pin numbers, passport numbers, driver’s license or state-issued identification numbers, military identification numbers, financial institution names, account and routing numbers, credit and debit card numbers, security questions and answers, and various health information including diagnoses, treatment, medical records, insurance information, and more.
UCMC has been serving patients in the Chicago area since 1927 as an academic medical health system.
The non-profit center offers medical education, research, and patient care, with over 10,000 employees.
Going deeper
According to the health center, an unauthorized actor accessed several UCMS employee email accounts between January 4th, 2024 and January 30th, 2024.
UCMC learned about the incident on January 6th, 2024, and took steps to terminate access and secure the email accounts.
The center also began an investigation and determined on March 28th, 2024 that personal information had been affected.
Impacted individuals included patients and their family members who may have received services.
The breach was reported to the HHS on May 24th and is considered under investigation. UCMS said they have begun alerting individuals.
Why it matters
The cause for the breach is listed as email hacking, which is generally preventable with the right security procedures and systems in place.
While UCMS has not provided details on how the incident occurred, it is likely the result of phishing or poor security policies (such as weak passwords).
Email hackers have increased in sophistication, especially in the age of AI, where it can be easier for malicious actors to craft compelling messages.
Security services like Paubox automatically mark suspicious emails, alerting administrators to phishing attempts.
Despite the importance of email security, many employees aren’t aware of how to properly handle or prevent incidents and may not know how devastating a singular incident can be.
Read more: New survey reveals gap in cybersecurity implementation
The big picture
The incident at UCMS is a reminder of how just a few compromised emails can lead to a massive data breach incident.
In recent months, data breaches have skyrocketed, and so have the consequences. More than ever, organizations are facing hefty penalties, lawsuits, and a decrease in reputation following a breach.
While UCMS took important steps to mitigate the attack and alert impacted individuals, it’s always better to prevent an attack before it occurs.
Read more: HIPAA Compliant Email: The Definitive Guide
Abby Grifno
