UC San Diego Health discloses data breach after employee email accounts hijacked

An array of personal, financial, and medical data is thought to have been compromised

UC San Diego Health has disclosed a data breach caused by compromised staff email accounts.

The healthcare operator is ranked first in San Diego, according to the 2021-2022 US News and World Report survey.

In a data breach notification posted on July 27, UC San Diego Health said that unauthorized access is likely to have occurred between December 2, 2020, and April 8, 2021.

Unknown attackers were potentially able to “access or acquire” patient data including full names, physical addresses, email addresses, dates of birth, Social Security numbers, government IDs, usernames, and passwords.

In addition, a wealth of healthcare-related information may have been exposed. This includes laboratory results, medical diagnosis records, and prescription and treatment information.

Payment information is also cited as involved in the breach.

Detection and response

UC San Diego Health became aware of suspicious activity on March 12 and the intrusion on April 8. The healthcare network then revoked access to the compromised employee email accounts.

“There is no evidence that other UC San Diego Health systems were impacted, nor do we have any evidence at this time that the information has been misused,” the security advisory reads.

The US Federal Bureau of Investigation has been notified and third-party cyber forensics experts have been pulled in to assist.

“This process of analyzing the data in the email accounts is ongoing,” the organization says.

“UC San Diego Health is moving as quickly as possible while taking the care and time to deliver accurate information about which data was impacted.”

Improved security

The medical institution is currently conducting a review of the data breach. Once concluded – with an estimated date of September – UC San Diego Health will reach out to students, employees, and patients involved “where current contact information is available”.

UC San Diego Health has since cycled employee credentials and disabled a number of access points. The organization added that improved security processes and procedures have been implemented.

One year of Experian IdentityWorks credit monitoring and identity theft will be offered to those impacted.

The Daily Swig has reached out to UC San Diego Health with additional queries and we will update when we hear back.