Minnesota Department of Human Services, the covered entity (CE), reported that threat actors gained access to a CE workforce member’s email account via a phishing attack. The email account contained data that included the electronic protected health information (ePHI) of 4,329 individuals. The ePHI involved included individuals’ addresses, zip codes, dates of birth, names, social security numbers, diagnoses and conditions, lab results, and medications. The CE notified individuals, the media, and HHS. The CE took corrective actions in response to the breach including resetting the password of the affected account and conducting a forensic analysis of the breach.
