Security Incident Information

---

What happened?

Augusta University was targeted by a series of fraudulent emails. These sophisticated “phishing” emails solicited usernames and passwords, giving attackers access to a small number of internal email accounts. 

How did Augusta University respond?

Upon recognizing the nature of the attack, we acted promptly to stop the intrusion: disabling the impacted email accounts, requiring password changes for the compromised accounts, and maintaining heightened monitoring of the accounts to ensure that no other suspicious activity was taking place.  

We simultaneously started an investigation into the incident and retained external cybersecurity professionals to analyze the extent of any compromise to the email accounts.

On July 31, 2018, investigators determined that email accounts accessed earlier by an unauthorized user may have given them access to the personal and protected health information of approximately 417,000 individuals. The forensic investigation determined that the compromise of the email accounts occurred during a limited period of time on September 10-11, 2017.

Will I receive a notification from Augusta University?

We will send notification letters via U.S. mail to affected individuals for whom it has addresses. We will provide substitute notice for affected individuals for whom we do not have addresses.

Who is affected?

Some individuals within the following categories may be impacted:  patients, students, employees and their dependents, some applicants to Augusta University and some who asked that their FAFSA data be sent to AU.

How can I determine if my information is affected?

You may call our toll-free call center from 9 a.m. to 9 p.m. Monday through Friday at 1-877-327-1090.

Why did Augusta University have my information?

If you are a patient, you provided AU Health with some of your protected health information or personal information in connection with medical services provided to you by an AU Health provider. For students and employees, personally identifiable information is part of your student or employee record.

What types of protected information are potentially involved?

The compromised email accounts that were accessed contained name and/or one or more of the following: date of birth, address, driver’s license number, medical record number, insurance information, prescription information, medical information, surgical information, diagnosis/condition, lab results, dates of service, treatment information, Social Security number and/or financial account information. If your Social Security number and/or financial account information was compromised and we have your mailing address, you will be notified in your notice letter.

Will credit monitoring be offered?

Affected individuals with Social Security numbers involved will be offered complimentary credit monitoring and identity theft restoration services, which will be explained in detail in the notice letters that will be mailed to individuals’ home addresses.

Why is Augusta University not offering credit monitoring to certain individuals?

While some individuals’ protected health information or personal information may have been contained in compromised email accounts, not all individuals’ Social Security numbers and/or driver’s license numbers were contained within the compromised accounts and are not at risk as a result of this incident. Since a credit monitoring service does not track activity related to medical, health or insurance information, credit monitoring would not be an effective way to track that information. Instead, individuals should review their “explanation of benefits statement” which they receive from their health insurance company.  Follow up with the insurance company or care provider for any items not recognized.

When was the information available to the unauthorized person(s)?

The forensic investigation concluded that the compromise of the email accounts occurred during a limited period of time on September 10-11, 2017. Therefore, the information could have been available to the unauthorized individual(s) on September 10-11, 2017.

What has the unauthorized person(s) done with my information?

To date, we are unaware of any actual or attempted misuse of your information resulting from this incident.

As a result of this incident, will I become a victim of identity theft?

To date, we are unaware of any actual or attempted misuse of your information resulting from this incident.

How can I protect my health information?

We have no information to date indicating that your protected health information involved in this incident was or will be used for any unintended purposes. As a general matter, however, the following practices can help to protect you from medical identity theft.

• Only share your health insurance cards with your health care providers and other family members who are covered under your insurance plan or who help you with your medical care.
• Review your “explanation of benefits statement” which you receive from your health insurance company. Follow up with your insurance company or the care provider for any items you don’t recognize. If necessary, contact the care provider on the explanation of benefits statement and ask for copies of medical records from the date of the potential access (September 10, 2017) to current date.
• Ask your insurance company for a current year-to-date report of all services paid for you as a beneficiary. Follow-up with your insurance company or care provider for any items you don’t recognize.

Why was there a delay in notification of this incident?

The attackers gained access to 24 employee email accounts, which were promptly identified and secured.  Some of these email accounts contained spreadsheets of information. Investigators had to manually review more than 364,000 emails and attachments. Unfortunately this complex review took a long time. We also identified a number of areas in which we will strengthen our cybersecurity.

Should I close my bank account?

If your notice letter states your financial account information was included you should contact your financial institution to determine if you should close your bank account. It is good practice to review your financial account statements on a regular basis and always be attentive when reviewing account information.

Should I cancel my credit card?

If your notice letter states that your credit card information was included, you should contact your credit card company to determine if you should close your account. It is good practice to review your financial account statements on a regular basis and always be attentive when reviewing account information.

Is my personal information safe with Augusta University?

Yes. The security of your personal information is critically important to us, and we take this responsibility very seriously. We have installed new leadership in critical areas and implemented several new policies, procedures and trainings to help prevent against future exposure.

What is Augusta University doing in light of this incident?

Upon learning of the attack, we promptly disabled the impacted email accounts, required password changes for the compromised accounts, and maintained heightened monitoring of the accounts. We are committed to maintaining the privacy of patient and personal information, and will continually evaluate and modify practices to enhance appropriate security and privacy measures including ongoing cybersecurity awareness for our workforce.

We have also appointed new leadership in key areas and are adding more sophisticated authentication procedures, changing information management policies, and adding technical screening to our email system. In addition, we are enhancing compliance staffing and training. Further, we are devoting considerable resources to ensure that the affected individuals are fully informed and protected as a result of this unfortunate incident.

What can I do now to protect myself?

We suggest you consider taking the following steps:

• Enroll in the credit monitoring services offered at no cost to you if included in your notice letter. (If you are eligible to enroll in credit monitoring services, enrollment instructions are contained in your notice letter);
• Place a Fraud Alert on your credit files;
• Obtain a free credit report;
• Take steps to protect your health and insurance information.

What is a fraud alert?

A fraud alert tells creditors to contact you personally before they open any new accounts.

How do I place a fraud alert on my account?

In order to place a fraud alert, you will need to call any one of the three major credit bureaus. (As soon as one credit bureau confirms your fraud alert, they will notify the others to place fraud alerts).

How long does a fraud alert last?

An initial fraud alert lasts 90 days and it is free; you may then renew the fraud alert for an additional 90 days.

Will a fraud alert stop me from using my credit cards?

No. A fraud alert will not stop you from using your credit cards or other accounts.

Can I still apply for a credit card after I place a fraud alert on my credit report?

Yes, but the verification process may be more cumbersome or may require more steps. Potential creditors will receive a message alerting them to the possibility of fraud and that creditors should re-verify the identity of a person applying for credit.

How do I place a Security Freeze on my credit files?

If you are very concerned about becoming a victim of fraud or identity theft, you may request a “Security Freeze” be placed on your credit file. A security freeze prohibits, with certain specific exceptions, the consumer reporting agencies from releasing your credit report or any information from it without your express authorization. You may place a security freeze on your credit report by sending a request in writing, by mail, to all three nationwide credit reporting companies. To find out more on how to place a security freeze, you can use the following contact information:

What should I do if I find suspicious activity on my credit reports or other accounts?

Promptly call your local law enforcement agency and file a police report. Get a copy of the police report, as many creditors will want the information it contains to absolve you of fraudulent debts. You may also file a complaint with the FTC at www.ftc.gov/idtheft or reach the FTC at 1-877-IDTHEFT (1-877-438-4338) or 600 Pennsylvania Avenue, NW, Washington, DC 20580. Your complaint will be added to the FTC’s Identity Theft Data Clearinghouse, where it will be accessible to law enforcers for their investigations.

When I called to place a fraud alert, they asked for my Social Security number. Is this ok?

Yes. The credit bureaus will indeed ask for your Social Security number and other personal information to verify your identity and avoid sending any credit report or correspondence to the wrong individual. However, we caution against you providing any information to any entity or person contacting you directly asking for your personal information.

How do I obtain a free credit report?

Under federal law, you are entitled to one free credit report every 12 months from each of the three major nationwide credit reporting companies. Call 1-877-322-8228 or request your free credit reports online at www.annualcreditreport.com. Once you receive your credit reports, review them for discrepancies. Identify any accounts you did not open or inquiries from creditors that you did not authorize. Verify all information is correct. If you have questions or notice incorrect information, contact the credit report company.