Phishing email fools Missouri university staff, compromises thousands

Share this article:

Employees of Missouri-based Saint Louis University fell victim to a phishing email that resulted in them providing account information, subsequently putting thousands at risk.

How many victims? More than 3,200 individuals were impacted.

What type of personal information? Names, Social Security numbers, direct deposit information and personal health information, including diagnoses, procedures and medical chart information.

What happened? Saint Louis University employees fell victim to a phishing scam and provided account information, which the attackers then used to gain unauthorized access to direct deposit information for staffers and personal health information for patients treated at the university's hospital.

What was the response? Saint Louis University notified law enforcement and hired a risk mitigation and response services provider. Affected individuals are being notified by mail and are being offered a free year of credit monitoring and identity theft protection services.

Details: Saint Louis University learned on Aug. 8 that some employees had responded to the phishing email on July 25. Although no unauthorized financial transactions have been reported so far, there were about 10 staffers who had direct deposit information changed. Attackers gained access to roughly 20 employee email accounts that contained personal health information on approximately 3,000 patients treated at the university's hospital. The email accounts also contained names and Social Security numbers for about 200 other people. Letters were sent to affected individuals beginning Oct. 7.

Quote: “It appears that the main target of this scam was the direct deposit information of these employees,” according to the notification posted on the Saint Louis University website. “At this time, there is no evidence to suggest that the unknown party accessed any of the personal information in the emails.”

Source: slu.edu, “Notice for Saint Louis University Patients Regarding Privacy Incident,” Oct. 7, 2013.

Share this article:

Sign up to our newsletters

POLL

More in The Data Breach Blog

Hackers breach social network MeetMe

Hackers took advantage of a vulnerability and were able to access information on an undisclosed number of MeetMe users.

Professor hacks University Health Conway in demonstration for class

A computer science professor from the City College of San Francisco accessed a University Health Conway server containing patient data as part of a demonstration for a class.

Another breach involving Onsite Health Diagnostics, Kansas City hospital impacted

Children's Mercy Hospital is notifying more than 4,000 individuals that their information may have been compromised after an Onsite Health Diagnostics system was breached.