Jefferson Healthcare hit by 'phishing' cyber attack that compromised 2,550 employees personal information. The compromised information included full names of individuals, as well as their dates of birth, phone numbers, home addresses, health insurance information, dates of service, and diagnosis and treatment information. Jefferson Healthcare officials immediately took steps to halt the unauthorized access to the employee’s email account and to prevent further access and also took immediate steps to enhance their information security systems.

Jefferson Healthcare, a healthcare provider based in Washington State, fell victim to a phishing-based cyberattack on November 9, 2020, which was detected three days later on November 12, 2020. The incident compromised the personal and sensitive data of 2,496 residents, including names, Social Security numbers, driver’s license/ID card numbers, full dates of birth, health insurance details, and medical records. The breach exposed highly confidential information, posing significant risks such as identity theft, financial fraud, and unauthorized access to medical histories. Given the nature of the stolen data—particularly Social Security numbers and medical records—the attack had severe implications for both patient privacy and regulatory compliance (e.g., HIPAA violations). The phishing attack targeted employees, leading to unauthorized access to internal systems where patient data was stored. While the exact financial or operational impact on Jefferson Healthcare was not disclosed, the exposure of such sensitive data typically results in long-term reputational damage, potential lawsuits, regulatory fines, and erosion of patient trust. The incident underscores the critical need for robust cybersecurity training, email filtering, and access controls in healthcare organizations to prevent similar breaches.