UnityPoint Health continued warning patients Tuesday of a data breach that could impact 1.4 million patients.According to a news release, on May 31, UnityPoint discovered the phishing attack on its business email system, notified law enforcement and started a computer forensics investigation.That investigation found the company received a series of fraudulent emails disguised to have come from an executive within UnityPoint. "Email is a very common way to trick people into doing all sorts of things,” said Doug Jacobson, who teaches classes on information warfare at Iowa State University.Patient information possibly included names, addresses, dates of birth, medical records numbers, and insurance information. The attackers might also have gained access to patients' Social Security numbers and/or driver's license numbers.UnityPoint said a payment card or bank account number might also have been accessed for a limited number of patients.Jacobson said email gives criminals space to craft a convincing narrative. He said organizations like UnityPoint Health should teach employees to beware of phony emails. "An organization, for example, should tell their employees that never, ever will anyone ask for your password via email,” he said.Jacobson advises anyone who sees something questionable in their inbox to notify the sender in person or on the phone. "'Hey, you know, I got an email request from you. Is that really what you want?’" he said.UnityPoint Health will offer free credit monitoring services for one year to individuals whose social security number and/or driver’s license number were included in the compromised email accounts.Patients who have questions or concerns regarding the data breach can call a helpline at 1-888-266-9285. UnityPoint Health continued warning patients Tuesday of a data breach that could impact 1.4 million patients. According to a news release, on May 31, UnityPoint discovered the phishing attack on its business email system, notified law enforcement and started a computer forensics investigation. Advertisement That investigation found the company received a series of fraudulent emails disguised to have come from an executive within UnityPoint. "Email is a very common way to trick people into doing all sorts of things,” said Doug Jacobson, who teaches classes on information warfare at Iowa State University. Patient information possibly included names, addresses, dates of birth, medical records numbers, and insurance information. The attackers might also have gained access to patients' Social Security numbers and/or driver's license numbers. UnityPoint said a payment card or bank account number might also have been accessed for a limited number of patients. Jacobson said email gives criminals space to craft a convincing narrative. He said organizations like UnityPoint Health should teach employees to beware of phony emails. "An organization, for example, should tell their employees that never, ever will anyone ask for your password via email,” he said. Jacobson advises anyone who sees something questionable in their inbox to notify the sender in person or on the phone. "'Hey, you know, I got an email request from you. Is that really what you want?’" he said. UnityPoint Health will offer free credit monitoring services for one year to individuals whose social security number and/or driver’s license number were included in the compromised email accounts. Patients who have questions or concerns regarding the data breach can call a helpline at 1-888-266-9285.<doc-sep>Support Local Journalism Your membership makes our reporting possible. {{featured_button_text}} Based on the investigation, UnityPoint believes the attack was more likely focused on diverting business funds from the organization than gaining access to patient information. UnityPoint sent notification letters Monday to the addresses of those affected by the incident. It said in the notice that it is "not aware of any misuse of patient information." UnityPoint is investigating the size and scope of the attack and working with law enforcement. It will offer free credit monitoring services for one year to those with Social Security numbers or driver's license numbers included in compromised email accounts. Those impacted will receive instructions on how to enroll in their notification letters. It has also established a help line at 1-888-266-9285 and posted a list of answers to frequently asked questions on its website. UnityPoint Health in Sioux City posted a statement to social media Monday afternoon acknowledging the incident.<doc-sep>
One of Iowa’s main hospital and clinic systems has notified about 1.4 million patients that their personal information might have been breached. UnityPoint Health officials said hackers used “phishing” techniques to break into the company’s email system. The company, based in West Des Moines, said the hackers could have obtained medical information, such as diagnoses and types of care, that was included in emails. "While we are not aware of any misuse of patient information related to this incident, we are notifying patients about what happened, what information was involved, what we have done to address the situation, and what patients can do to help protect their information,” RaeAnn Isaacson, UnityPoint’s privacy officer, said in a press release Monday. The hackers also might have obtained some patients’ financial information, such as bank account numbers, UnityPoint said. The hackers used official-looking emails to obtain employees’ passwords, leading to the breach, the company said. The company said after it discovered the problem May 31, it hired outside experts and notified the FBI. UnityPoint said it doesn’t believe the hackers were after private health information. It suspects they wanted to divert payments, such as for payroll or outside business expenses. Still, the company is asking patients to keep close track of account statements for signs of fraud, such as inappropriate charges included in an “explanation of benefits.” The company is offering free credit monitoring to patients whose Social Security numbers or driver’s license numbers were included in the stolen emails. The company said its electronic medical records system and billing systems were not affected by the attack on its email system. The company said it is taking steps to strengthen its computer security. The new incident is separate from one reported in April, when UnityPoint Health notified about 16,400 patients of a separate phishing email attack.