A threat actor accessed the account of Mercy Iowa City and used it to send spam and phishing emails.
The compromised information includes name, Social Security number, driver’s license number, date of birth, medical treatment information, and health insurance information.
Ultimately, Mercy Iowa City's investigation—aided by a forensics security company—found that there was no proof that the employee's account had been misused for the purposes of collecting or disclosing personal information.
"id": "MER72225523",
"linkid": "mercy-iowa-city",
"type": "Breach",
"date": "11/2020",
"severity": "80",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"