Payroll Information Breach Leads RoundupDisabled Firewall an Issue at Clinic
In this week's breach roundup, Calvert Internal Medicine Group in Prince Frederick, Md., reports a suspected breach involving payroll-related information. Also, Independence Care System, a long-term care insurance provider, is notifying about 2,400 members about a laptop theft.
See Also: Why CASBs Matter to Cloud Security
Tech Support Error Leads to Breach
Calvert Internal Medicine Group in Prince Frederick, Md., is notifying all active and terminated employees of a suspected IT breach involving payroll-related information.
The incident is believed to have started when a finance department employee contacted payroll services provider ADP regarding a time clock data transmission problem, according to a notice provided to the Maryland Attorney General's Office.
During the call, ADP technical support took control of the employee's computer and disabled the computer's firewall. After the call to ADP was completed, the ADP support member failed to reactivate the firewall, according to the notice.
Several weeks later, the medical group was notified by its domain service that about 9,000 spam e-mails were identified as originating from the group's domain, the notice said. The spam originated from the finance department employee's e-mail account. Upon investigation, malware was detected in the spam inbox of the employee's computer.
Then another employee was notified of irregular personal financial activity by a federal agency, the notice said.
As a result, all current and former employees are being notified of the incident, which may have exposed payroll-related information, including employees' names, addresses and Social Security numbers, the notice explains. It's unclear how many employees were affected.
The employee's e-mail account was disabled and replaced with a new, password-protected, e-mail address. Passwords were also changed for ADP, the accounting system, and banking services portals and software, the notice said.
Insurer Reports Laptop Theft
Independence Care System, a long-term care insurance provider based in New York, is notifying more than 2,400 of its members about the theft of an unencrypted laptop containing sensitive information.
The insurer reports that it learned on May 7 that a laptop was stolen from the home of a staff member. For nearly 60 percent of the members affected, compromised information included name, ZIP code and member ID number. For the others affected, further compromised details include street address, phone number, Medicaid ID number, and enrollment and/or disenrollment dates.
The company is offering its affected members one year of free credit monitoring services.
Workstation Compromised by Malware
The University of Massachusetts Amherst is notifying more than 1,600 patients at the university's Center for Language, Speech and Hearing that malware was found on a workstation at the center.
An investigation by the university's office of information technologies found no evidence that any data was copied, the university reports.
Information on the workstation included Social Security numbers, addresses, names, dates of birth, health insurance company names, insurance numbers, physician names, and diagnoses and procedure codes.
As a result of the incident, the university says it has taken steps to improve the support and security for all workstations, installed automated software to detect malicious activity and identified files in departmental computers containing personal information. Staff members will also receive additional training in security practices.
10-Year Prison Sentence in ID Theft Case
The U.S. Department of Justice has announced that a court has ordered a 10-year prison sentence for Rhashema Deramus, of Montgomery, Ala., who was convicted of ID theft and tax fraud in a case linked to hospital data.
Last year, Deramus pleaded guilty to theft of government money, fraudulent use of debit cards, and aggravated identity theft - all related to filing fraudulent tax returns, according to the Justice Department.
The IDs used in the crimes came from patient information stolen by another individual in the crime ring, Angeline Austin, a former contract worker of Troy Regional Medical Center in Montgomery. Austin was sentenced earlier this year to 65 months in federal prison for her involvement, the Justice Department says.