CSI Laboratories said this week that it experienced a phishing attack on July 8 after an employee’s individual mailbox was compromised.
The firm, which operates a CLIA-certified and CAP-accredited cancer reference laboratory in Alpharetta, GA, said that it believes that the unauthorized access to a single employee mailbox occurred not to obtain patient information, but to commit financial fraud and redirect customer healthcare provider payments from CSI to the malicious actor.
The firm said it immediately took steps to isolate and secure its systems and investigate the incident.
Specifically, as part of an investigation, CSI determined that an unauthorized intruder acquired certain files from the affected employee’s mailbox, including documents that may have contained patient information.
Since that time, the laboratory firm has been analyzing the impacted files to understand what information may have been accessed or acquired.
The impacted files were related to invoices sent to CSI’s healthcare provider customers. The information in the files differed from invoice to invoice; however, the invoices usually included the patient’s name and a unique patient number assigned to samples.
There was no impact on CSI’s network or information systems, the firm added.
