The target: Revere Health, a Utah based multispecialty physician group.
The take: Personally Identifiable Information of 12,000 patients including: medical record numbers, dates of birth, provider names, and procedures and insurance names.
The attack vector: An employee of Revere Health fell victim to a phishing attack, allowing the attacker control of their email account.
Phishing attacks against individual employees remain one of the greatest security threats to an entire organization. Regular social engineering and awareness testing and training, along with tone-from-the-top messaging to emphasize the importance of critical thinking and caution are crucial to protecting sensitive information assets.