Mercy Health Email Security Breach Exposes Medicare Beneficiaries

Exploit: Email security breach
Mercy Health: Catholic healthcare ministry serving Ohio and Kentucky

Risk to Small Business: 2 = Severe Risk: A compromised email account at a third-party vendor in 2018 ultimately resulted in compromised personal information for Mercy Health patients. The third-party vendor, OS Inc., was involved in a similar data breach last year and was responsible for updating information for Medicare beneficiaries and billing for certain services. The incident reflects the complicated cybersecurity threats facing institutions working with third parties, specifically as it relates to managing personally identifiable information.

Individual Risk: 2.285 = Severe Risk: Hackers did not gain access to financial or medical information, but they were able to view significant amounts of personally identifiable information, including names, dates of birth, dates of service, patient identification numbers, Social Security numbers, and medical record numbers.

Customers Impacted: Unknown
How it Could Affect Your Customers’ Business:  Working with contractors and third parties is often a requirement in today’s digital ecosystem. However, those partnerships can create vulnerabilities that organizations need to address before allowing third parties to access their data. Therefore, robust cybersecurity protocols should be a prerequisite for any business relationship that includes that exchange of sensitive personal information.

Risk Levels:

1 - 1.5 = Extreme Risk
1.51 - 2.49 = Severe Risk
2.5 - 3 = Moderate Risk

*The risk score is calculated using a formula that considers a wide range of factors related to the assessed breach.