The covered entity (CE), Unum Group, reported that an employee was the victim of an email phishing scheme. The protected health information (PHI) involved included names, addresses, dates of birth, Social Security numbers, health diagnoses, and employer information. This breach affected 532 individuals. The CE retained legal counsel and hired forensic investigators to assist with the investigation. The CE provided breach notification to HHS and affected individuals. In addition, Unum deleted the phishing email from mailboxes, forced password resets, updated and completed a risk analysis, implemented multi-factor authentication, reduced email retention, blocked suspicious websites, and provided supplemental HIPAA training to its workforce. OCR provided the CE with technical assistance regarding timely breach notification. OCR obtained assurances that the CE met its notification requirements and implemented the corrective actions noted above.
2026-09-25 · attack: unknown to hacking · backfill source
2026-09-25 · data_types: [] to ["names","health"] · backfill source
2026-09-25 · records_basis: empty to hhs · backfill source
2026-09-25 · records: empty to 532 · backfill source
2026-09-25 · disclosed: 2019-12-30 to 2019-01-24 · backfill source
2026-09-25 · summary: empty to The covered entity (CE), Unum Group, reported that an employee was the victim of an email phishing scheme. The protected health information (PHI) involved included names, addresses, dates of birth, Social Security numbers, health diagnoses, · backfill source
