The University of Vermont Medical Center

The University of Vermont Medical Center suffered from a phishing incident in May 22 after an unauthorised third party got access to an employee's email account.

2300 UVM Medical Centre patients were impacted by this occurrence.

An email in the account was found to have patient information, including possible patient names, addresses, dates of birth, medical record numbers, and clinical details including diagnoses, treatments, doctors' names, and prescriptions.

The email account did not contain the patients' social security numbers or financial details such as bank account or credit card numbers.

They started an investigation and swiftly terminated the employee's email account.

Source: https://www.databreaches.net/university-of-vermont-medical-center-notifies-2300-patients-of-phishing-incident/

TPRM report: https://scoringcyber.rankiteo.com/company/university-of-vermont-medical-center

"id": "the1159261022",
"linkid": "university-of-vermont-medical-center",
"type": "Data Leak",
"date": "05/2017",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'customers_affected': '2300 patients',
                        'industry': 'Healthcare',
                        'location': 'Vermont',
                        'name': 'University of Vermont Medical Center',
                        'type': 'Healthcare'}],
 'attack_vector': 'Email',
 'data_breach': {'number_of_records_exposed': '2300',
                 'personally_identifiable_information': ['Names',
                                                         'Addresses',
                                                         'Dates of birth',
                                                         'Medical record '
                                                         'numbers'],
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Patient names',
                                              'Addresses',
                                              'Dates of birth',
                                              'Medical record numbers',
                                              'Clinical details including '
                                              "diagnoses, treatments, doctors' "
                                              'names, and prescriptions']},
 'date_detected': '2023-05-22',
 'description': 'The University of Vermont Medical Center suffered from a '
                'phishing incident in May 22 after an unauthorised third party '
                "got access to an employee's email account.",
 'impact': {'data_compromised': ['Patient names',
                                 'Addresses',
                                 'Dates of birth',
                                 'Medical record numbers',
                                 'Clinical details including diagnoses, '
                                 "treatments, doctors' names, and "
                                 'prescriptions'],
            'systems_affected': 'Email account'},
 'initial_access_broker': {'entry_point': 'Phishing email',
                           'high_value_targets': 'Patient data'},
 'investigation_status': 'Ongoing',
 'post_incident_analysis': {'root_causes': 'Phishing attack leading to '
                                           'unauthorized access'},
 'response': {'containment_measures': "Terminated the employee's email "
                                      'account'},
 'threat_actor': 'Unauthorized third party',
 'title': 'Phishing Incident at University of Vermont Medical Center',
 'type': 'Phishing',
 'vulnerability_exploited': 'Human error leading to unauthorized access'}