An Edinburgh mental health clinic suffered from a data breach incident that affected hundreds of client contact details after the phishing scam.
The compromised information contained a number of important documents and their e-mail addresses.
The hack did not provide access to medical and health records because they are stored on a separate, encrypted server.
They investigated the incident and immediately took action which involved locating and removing the phisher from their systems, securing email traffic and alerting those clients whose information potentially been compromised.
They also alerted the police and the ICO. They collaborated with IT and data specialists to close the breach, safeguard the data, and contact people who would likely be impacted.
"id": "EDI2335261222",
"linkid": "edinburgh-mental-health",
"type": "Breach",
"date": "05/2021",
"severity": "50",
"impact": "2",
"explanation": "Attack limited on finance or reputation"