PHI of 521,000 Individuals Compromised in Security Breach at Morley Companies
Morley Companies, a Saignaw, MI-based provider of business services, has recently announced it was the victim of a cyberattack that started on August 1, 2021, that prevented access to data in its information systems.
Rapid action was taken to isolate the affected systems and a leading cybersecurity firm was engaged to investigate and determine the nature and scope of the security incident. In addition to encrypting data on its systems, the attackers exfiltrated certain data from its systems.
A comprehensive review was conducted of all files on its systems that could have been accessed by the attackers, and Morley Companies then started collecting contact information for those individuals to allow notification letters to be sent. Morley Companies said that process was completed in early 2022, and notification letters started to be sent to affected individuals on February 1, 2022.
The forensic investigation confirmed the following types of information were potentially accessed and/or stolen in the cyberattack: Names, addresses, Social Security numbers, birthdates, client identification numbers, medical diagnostic and treatment information, and health insurance information.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
Morley Companies said it has reviewed its data security safeguards and has now made alterations to its cyber environment to prevent similar attacks in the future. Affected individuals have been offered a complimentary membership to credit monitoring and identity theft protection services.
The security breach has been reported to law enforcement and the Department of Health and Human Services’ Office for Civil Rights (OCR). The OCR data breach portal indicates the protected health information of 521,046 individuals was potentially compromised.
