Covenant HealthCare has confirmed that an unauthorized individual gained access to two employees' email accounts, potentially exposing about 45,000 patients' information.
The accounts were accessed May 4, 2020, and contained patients' personal information like names, addresses, Social Security numbers, and medical diagnosis and clinical information.
An FBI investigation found that hackers repeatedly combined vulnerable user IDs with different passwords until a combination worked, allowing them to access the two email accounts, Covenant HealthCare spokesperson Kristin Knoll told Becker's.
According to the FBI, the hackers were attempting to sell Covenant's login and password information on the dark web.
The Saginaw, Mich.-based health system posted a notice of the data security incident on its website, saying it was unable to secure contact information for all 45,000 patients who may be affected.
To prevent future attacks, Covenant HealthCare implemented multi-step authentication for employee email accounts.
While Covenant HealthCare has found no evidence to indicate any misuse of patients' personal information as a result of this incident, it recommends that those potentially affected monitor their accounts.
"We deeply apologize that this occurred and will continue to take additional actions to maintain the privacy of personal information in our possession," Ms. Knoll said.
To read the full disclosure, click here.