Vandalia Health Mon Medical Center in Morgantown, W.Va., disclosed a phishing attack that exposed the personal information of 2,173 patients.
The hospital, formerly known as Mon General and legally registered as Monongalia County General Hospital Co., filed the breach report with HHS’ Office for Civil Rights on July 31. The agency posted the number in August.
The hospital discovered May 6 that an unauthorized party had gained access to a small number of employee email mailboxes, according to a substitute notice posted to its website. Vandalia Health terminated the unauthorized access the same day and hired an outside forensic security firm to investigate. The probe concluded in late June and found no other hospital systems or data storage were affected.
Exposed information varied by individual and may have included names, dates of birth, email addresses, phone numbers, Social Security numbers, and health and health insurance information. The hospital reset user credentials following the incident and said it is evaluating additional technical safeguards.
Affected individuals are being offered two years of free credit monitoring through notification letters mailed to their homes.
At the Becker's 11th Annual IT + Revenue Cycle Conference: The Future of AI & Digital Health, taking place September 14–17 in Chicago, healthcare executives and digital leaders from across the country will come together to explore how AI, interoperability, cybersecurity, and revenue cycle innovation are transforming care delivery, strengthening financial performance, and driving the next era of digital health. Apply for complimentary registration now.
