Phishing email fools Missouri university staff, compromises thousands

Share this article:

Employees of Missouri-based Saint Louis University fell victim to a phishing email that resulted in them providing account information, subsequently putting thousands at risk.

How many victims? More than 3,200 individuals were impacted.

What type of personal information? Names, Social Security numbers, direct deposit information and personal health information, including diagnoses, procedures and medical chart information.

What happened? Saint Louis University employees fell victim to a phishing scam and provided account information, which the attackers then used to gain unauthorized access to direct deposit information for staffers and personal health information for patients treated at the university's hospital.

What was the response? Saint Louis University notified law enforcement and hired a risk mitigation and response services provider. Affected individuals are being notified by mail and are being offered a free year of credit monitoring and identity theft protection services.

Details: Saint Louis University learned on Aug. 8 that some employees had responded to the phishing email on July 25. Although no unauthorized financial transactions have been reported so far, there were about 10 staffers who had direct deposit information changed. Attackers gained access to roughly 20 employee email accounts that contained personal health information on approximately 3,000 patients treated at the university's hospital. The email accounts also contained names and Social Security numbers for about 200 other people. Letters were sent to affected individuals beginning Oct. 7.

Quote: “It appears that the main target of this scam was the direct deposit information of these employees,” according to the notification posted on the Saint Louis University website. “At this time, there is no evidence to suggest that the unknown party accessed any of the personal information in the emails.”

Source:, “Notice for Saint Louis University Patients Regarding Privacy Incident,” Oct. 7, 2013.

Share this article:

Sign up to our newsletters


More in The Data Breach Blog

Malware on Backcountry Gear website, payment cards compromised

Malware was installed on the Backcountry Gear website for roughly three months, during which payment cards may have been compromised.

Programming error results in CVS Caremark mailing blunder

About 350 CVS Caremark customers are being notified that a programming error resulted in mailers containing their personal information being sent to the wrong customers.

Seattle University donor checks possibly exposed due to settings error

Seattle University is notifying an undisclosed number of donors that anyone with a Seattle University computer account could have viewed scanned checks.