Michigan Medicine notifies 58,000 people of potential data breach after cyberattack

Michigan Medicine has notified nearly 58,000 individuals about the potential exposure of patient health information following a cyberattack in July. The breach occurred on July 30, when an employee’s email account was compromised after they accepted an unsolicited authentication prompt.

Officials from Michigan Medicine stated that the investigation did not confirm that patient data was specifically targeted, though data theft could not be ruled out. A thorough analysis of the compromised email account and its contents between August 21 and August 29 led to the notification of 57,891 affected individuals.

Some of the emails in the compromised account contained identifiable patient information, including names, medical record numbers, and details related to diagnostics and treatments. However, officials confirmed that no Social Security numbers, credit card information, or banking details were included in the breached data.

Following the discovery, Michigan Medicine immediately blocked the cyberattacker’s IP address and changed passwords to prevent further access. The employee involved in the incident faced disciplinary action, and steps were taken to enhance the health system’s security protocols. These measures included reducing the email retention period, modifying identity verification processes, and increasing education on multifactor authentication.

Michigan Medicine’s chief compliance officer, Jeanne Strickland, expressed regret over the incident and emphasized the organization’s commitment to patient privacy. “We are constantly working to minimize the threat of patient data being exposed, and when incidents like this occur, we immediately take steps to investigate,” Strickland said.

Notifications to the affected individuals began on September 26. Michigan Medicine has provided a toll-free Assistance Line at 1-877-225-2078 for those concerned about the breach. Affected individuals are also advised to monitor their medical insurance statements for any signs of fraud.