UMass Memorial Health

On October 15, 2021, UMass Memorial Health disclosed a data breach stemming from unauthorized access to employee email accounts between June 24, 2020, and January 7, 2021. The incident was detected during a security review on August 25, 2021, revealing that 3,099 individuals including patients and employees had their sensitive data exposed. Compromised information included Social Security numbers, financial account details, and other personally identifiable data. The breach posed significant risks of identity theft and financial fraud, prompting UMass Memorial to offer one year of free identity theft protection services to affected parties. The prolonged exposure window (over six months) heightened the potential for misuse of the stolen data, though no evidence of actual fraud was confirmed at the time of disclosure. The breach underscored vulnerabilities in email security protocols and the critical need for timely detection of unauthorized access in healthcare systems, where sensitive patient and employee data are prime targets for cybercriminals.

Source: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/472311e2-fa16-4151-9a28-8b894b291514.shtml

TPRM report: https://www.rankiteo.com/company/umass-memorial-medical-center

"id": "uma036091825",
"linkid": "umass-memorial-medical-center",
"type": "Breach",
"date": "6/2020",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization’s existence"

{'affected_entities': [{'customers_affected': '3,099 individuals',
                        'industry': 'Healthcare',
                        'location': 'Massachusetts, USA',
                        'name': 'UMass Memorial Health',
                        'type': 'Healthcare Provider'}],
 'customer_advisories': 'Offered one year of identity theft protection '
                        'services to affected individuals',
 'data_breach': {'number_of_records_exposed': '3,099',
                 'personally_identifiable_information': 'Yes',
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Social Security numbers',
                                              'financial account information']},
 'date_detected': '2021-08-25',
 'date_publicly_disclosed': '2021-10-15',
 'description': 'On October 15, 2021, UMass Memorial Health reported a data '
                'breach involving unauthorized access to email accounts '
                'between June 24, 2020, and January 7, 2021. The breach '
                'compromised the data of 3,099 individuals, including '
                'sensitive information like Social Security numbers and '
                'financial account information. Affected individuals were '
                'offered one year of identity theft protection services.',
 'impact': {'data_compromised': ['Social Security numbers',
                                 'financial account information'],
            'identity_theft_risk': 'High (identity theft protection services '
                                   'offered)',
            'payment_information_risk': 'Yes',
            'systems_affected': ['email accounts']},
 'investigation_status': 'Completed (review conducted on 2021-08-25)',
 'response': {'communication_strategy': 'Public disclosure and offer of '
                                        'identity theft protection services'},
 'title': 'UMass Memorial Health Data Breach (2021)',
 'type': 'Data Breach'}