UConn Health Phishing Attack Affected 326,000

As announced in February of 2019, UConn Health was the target of a massive phishing attack which compromised the information of 326,000 patients.

The health system noted in their announcement that hackers accessed employee email accounts which were then used to access patient data. Through the breach, a variety of information may have been compromised including names, birth dates, addresses, billing details, and appointment details.

“Because we cannot isolate exactly what, if any, information may have been accessed, we notified individuals whose information was in the impacted accounts,” officials said in the announcement according to HealthITSecurity.com. “The incident had no impact on our computer networks or electronic medical record systems.”

For a smaller group of patients, around 1,500 people, Social Security numbers were also breached in the phishing attack. These patients will reportedly be able to receive free credit monitoring and identity theft protection for a year in light of the sensitive information that was exposed.

Patients have even taken legal action in a UConn Health class action lawsuit. Plaintiff Yoselin Martinez alleges that the University of Connecticut health center had a responsibility to protect consumer information but failed to “implement adequate and reasonable cybersecurity procedures and protocols.”

“Among other things, [UConn Health] failed to exercise reasonable care, and to implement adequate cybersecurity training, including, but not limited to, how to spot phishing emails from unauthorized senders,” the UConn phishing class action lawsuit alleges.

According to Martinez, UConn failed yet again to protect consumers when they didn’t take steps to detect unauthorized access. This reportedly resulted in intruders having access to sensitive patient data for months.

Martinez alleges that she experienced identity theft as a result of the UConn Health data breach. She says she was hit with a fraudulent charge that resulted in an overdraft – allegedly causing her financial injury.

“No one can know what else the cybercriminals will do with the compromised PII/PHI,” Martinez claims in her UConn class action lawsuit. “However, what is known is that UCONN Health patients will be for the rest of their lives at a heightened risk of further identity theft and fraud.”

The UConn class action also claims that the health center failed to inform consumers in a timely fashion. Although the breach reportedly occurred in August 2018, Martinez claims that UConn did not resolve their investigation until December 2018. Even worse, Martinez and other consumers were allegedly only told about it six months later in February.

Martinez seeks injunctive relief which would order UConn to make changes to their cybersecurity and prevent future data breaches. Her class action also seeks damages, restitution, disgorgement, court costs, and attorneys’ fees.

Overview: UConn Health

UConn Health is a medical center which is integrated as a part of the University of Connecticut Schools of Medicine and Dental Medicine. According to the health center’s website, it serves as “a vibrant, integrated academic medical center that is entering an era of unprecedented growth in all three areas of its mission: academics, research, and clinical care.”

Join a Free Hospital Ransomware Attack Class Action Lawsuit Investigation

If you were a patient at a hospital or healthcare facility affected by a ransomware attack that impacted your medical care, you may qualify to join a hospital ransomware attack class action lawsuit investigation.

Learn More

This article is not legal advice. It is presented
for informational purposes only.