Michigan Medicine Notifies 33K Patients of Phishing Attack

Michigan Medicine notified 33,850 patients of a phishing attack that may have exposed their health information. A cyber attacker targeted Michigan Medicine in August 2022 with a scam that lured employees to a webpage that got them to enter their login information.

As a result, four Michigan Medicine employees entered login information and accepted multifactor authentication prompts, enabling the attacker to access their email accounts. Michigan Medicine said it immediately disabled the accounts upon discovery.

“No evidence was uncovered during the investigation to suggest that the aim of the attack was to obtain patient health information from the compromised email accounts, but data theft could not be ruled out,” the notice stated.

Some email accounts contained patient names, addresses, birth dates, treatment information, medical record numbers, and health insurance information.

“Patient privacy is extremely important to us, and we take this matter very seriously. Michigan Medicine took steps immediately to investigate this matter and is implementing additional safeguards to reduce risk to our patients and help prevent recurrence,” Jeanne Strickland, Michigan Medicine chief compliance officer, said in the statement.

Michigan Medicine noted that it had already implemented robust training programs to prevent phishing, and the four employees who fell for the scam had taken part in that training and will be “subject to disciplinary action under Michigan Medicine policies and procedures.”