GRAND RAPIDS, Mich. — Network180, the Kent County mental health authority, has been the victim of a phishing attack. It exposed the information of one Network180 user's email account, and as many as 59,000 people were impacted.
In a letter sent to patients dated Dec. 22, 2023, Network180 informed one patient their information had been leaked on Oct. 18, 2023.
The spokesperson for Network180, Mary Ann Sabo, issued FOX 17 the following statement:
"The Kent County Mental Health Authority d/b/a Network180 was the victim of a phishing attack in October that exposed information in the email account of a Network180 user.
"When we became aware of the unusual activity on that account, we immediately contacted our IT department to contain the incident and also engaged an outside forensics team. We also reported the incident to the FBI. Based on the forensic team’s investigation and analysis of the data impacted, we believe protected health information (PHI) and personal identifying information of current and former employees and healthcare clients was exposed.
"We have taken additional steps to strengthen the security of the environment and to ensure future incidents are unsuccessful, including hiring cybersecurity staff to proactively monitor our systems and implementing the recommendations of the forensics experts, including additional training of our employees and vendors. We do not believe any of the information that may have been accessed has been misused. Out of an abundance of caution, we are offering 12 months of free credit monitoring services.
"We take the protection of personal information seriously and sincerely apologize to our employees and healthcare clients for any concern this incident may have caused."
Network180 reported approximately 59,000 people's information was potentially compromised to various government agencies, including the Office of Civil Rights of U.S. Department of Health and Human Services and the Michigan Department of Health and Human Services. Network180 believes there are some duplicate names in the 59,000 impacted.
Network180 was required to make the report.
When asked why it took nearly two months to report the breach, Network180 told FOX 17 they had forensic experts working around the clock to identify those individuals whose information may have been compromised in order to provide notice. Network180 says that can take quite a bit of time, as information isn't organized neatly in a spreadsheet and the entire contents of an email inbox may have been hacked, resulting in potentially thousands of people's information being at risk.
Possible information leaked includes date of birth, driver's license numbers, social security numbers, medical information, demographic information and financial information.
FOX 17 asked, because Network180 works with the unhoused or transient members of the community, how they reached out to everyone who may not receive a letter. Network180 says they have posted the notice and FAQs to their website.
Read Network180’s notice of the breach:
Network180 Substitute Notice by WXMI on Scribd
