Phishing email fools Missouri university staff, compromises thousands

Share this article:

Employees of Missouri-based Saint Louis University fell victim to a phishing email that resulted in them providing account information, subsequently putting thousands at risk.

How many victims? More than 3,200 individuals were impacted.

What type of personal information? Names, Social Security numbers, direct deposit information and personal health information, including diagnoses, procedures and medical chart information.

What happened? Saint Louis University employees fell victim to a phishing scam and provided account information, which the attackers then used to gain unauthorized access to direct deposit information for staffers and personal health information for patients treated at the university's hospital.

What was the response? Saint Louis University notified law enforcement and hired a risk mitigation and response services provider. Affected individuals are being notified by mail and are being offered a free year of credit monitoring and identity theft protection services.

Details: Saint Louis University learned on Aug. 8 that some employees had responded to the phishing email on July 25. Although no unauthorized financial transactions have been reported so far, there were about 10 staffers who had direct deposit information changed. Attackers gained access to roughly 20 employee email accounts that contained personal health information on approximately 3,000 patients treated at the university's hospital. The email accounts also contained names and Social Security numbers for about 200 other people. Letters were sent to affected individuals beginning Oct. 7.

Quote: “It appears that the main target of this scam was the direct deposit information of these employees,” according to the notification posted on the Saint Louis University website. “At this time, there is no evidence to suggest that the unknown party accessed any of the personal information in the emails.”

Source:, “Notice for Saint Louis University Patients Regarding Privacy Incident,” Oct. 7, 2013.

Share this article:
You must be a registered member of SC Magazine to post a comment.

Sign up to our newsletters


More in The Data Breach Blog

Backup hard drive stolen from law firm contained personal info

Social security numbers were among the information on a backup hard drive that was stolen from an employee of Imhoff and Associates, PC.

POS malware infections at two OTTO pizzeria locations in Maine

About 900 customers at two OTTO pizzeria locations in Portland, Maine, had payment card data compromised after POS malware was discovered on terminals.

Los Angeles-based health system breached; more than 500 patients affected

Personal information on more than 500 Cedars-Sinai Health System patients was compromised after a laptop was stolen from an employee's home.