One Compromised Email. 1,600 People Notified.

The Incident

It started with a tip. People outside the organization reported receiving phishing emails from an employee's account at a healthcare services provider. Someone had gained unauthorized access and was using the compromised mailbox to send malicious messages.

What looked like a single compromised account turned out to be bigger. The threat actor had used phishing and session cookie abuse to access three employee email accounts, giving them visibility into emails, attachments, and files containing protected health information.

The Response

Converge engaged IR panel vendors for digital forensics and legal consultation. The forensics team confirmed the scope: three accounts compromised, with the threat actor gaining access through a phishing email and then abusing session cookies to maintain persistence.

A separate Converge panel vendor was brought in to data mine the contents of the compromised accounts. The goal was to determine exactly what information was exposed and who was affected. After reviewing the accessed files, the team identified over 1,600 individuals whose personal or health information may have been compromised.

Converge coordinated the full notification process. Letters were sent to all 1,600+ individuals, and credit monitoring services were provided through another panel provider. Three different Converge panel vendors worked in parallel: forensics, data mining, and notification/monitoring. This is where having a pre-vetted, coordinated vendor panel makes a real difference. No time was lost sourcing and onboarding providers.

The Outcome

All compromised accounts were secured. 1,600+ individuals were notified and offered credit monitoring. HHS OCR opened an inquiry due to the number of individuals impacted, and the regulatory matter was addressed.

Total cost came in at approximately $66,000. For a breach that touched over 1,600 people and triggered a federal regulatory inquiry, this was a contained outcome, largely because of fast identification, parallel vendor workstreams, and efficient notification.

Key Takeaway

A single phishing email can cascade into a full breach notification event affecting thousands of people. MFA is the most effective single control you can implement. Pair it with restrictions on sharing confidential data over email, and you dramatically reduce the blast radius of an account compromise.