Hackers recently gained access to the email systems at the Mid-Valley Behavioral Care Network, officials told Salem Reporter on Tuesday.
The organization manages mental health benefits for people on the Oregon Health Plan in Marion and Polk counties, and officials said the attack happened around June 25.
Executive Director Justin Hopkins said hackers only had access to emails, not databases of health records or claims filed by OHP members. Still, he said it’s possible hackers saw names, dates of birth, social security numbers, addresses and other personal information.
Hopkins said his staff has already contacted anyone who may have been impacted.
The hack stemmed from a phishing email, whereby fake emails are sent asking people to enter private passwords. Two staffers’ emails accounts were hacked, he said.
Technology experts believe the hackers then used their access to reach out to other people, Hopkins said.
“(The staffers) entered their credentials and about a day later we realized somebody else was sending emails from their account to get to higher-level people and we immediately shut it down, the minute we figured out what was going on,” he said. “But there was probably a 24-hour period where someone may have had access to our (emails).”
Federal laws governing health privacy and state laws around identity theft both mandate alerting potential parties of compromised information, Hopkins said.
Hopkins said responses to the attack by its information systems will cost money, but he said it will be covered by insurance.
This story may be updated.
Have a tip? Contact reporter Troy Brynelson at 503-575-9930, [email protected] or @TroyWB.
