Heart Care Centers of Illinois Data Breach from Phishing Attack

Originally published on CyberNetSec.

Executive Summary

Heart Care Centers of Illinois (HCCI), a cardiovascular medical practice, is notifying patients and employees of a major data breach that exposed a vast amount of Protected Health Information (PHI) and Personally Identifiable Information (PII). The incident stemmed from a phishing attack that compromised an employee's email account between August and November 2024. The breach went undiscovered for over a year, until January 2026. The exposed data includes highly sensitive information such as Social Security numbers, financial account details, and specific medical diagnoses and treatment information. The long delay between the compromise and its discovery highlights significant challenges in detecting historical breaches within email systems.

---

Threat Overview

The root cause of the breach was a successful phishing attack that gave an unauthorized third party access to an HCCI employee's email account. This type of attack is common in the healthcare sector, where a single compromised account can serve as a gateway to a treasure trove of sensitive data.

Key Points:

• Attack Vector: Phishing (T1566 - Phishing).
• Compromise Duration: The attacker had access from August 22, 2024, to November 6, 2024.
• Delayed Discovery: The breach was not discovered until January 15, 2026, during an investigation into a separate, unrelated incident.
• Data Review Completion: A full review of the compromised mailbox to identify affected individuals and data types was not completed until June 11, 2026.

Technical Analysis

The attack followed a classic email compromise pattern. After the employee fell for a phishing lure, the attacker gained access to their mailbox using stolen credentials (T1078 - Valid Accounts). The attacker then had months of unfettered access to search for and exfiltrate sensitive data contained within emails and attachments.

Exposed Data Includes:

• PII: Names, addresses, Social Security numbers, dates of birth, driver's license numbers, passport numbers.
• Financial Information: Payment card numbers, financial account information.
• PHI: Medical diagnoses, condition information, treatments, prescriptions, health insurance details.

This incident highlights the risk of using email as a de facto filing system for sensitive information. Without specific monitoring for anomalous access or data exfiltration from mailboxes, such breaches can remain hidden for long periods.

MITRE ATT&CK Techniques

• T1566 - Phishing: Used to steal the employee's email credentials.
• T1078 - Valid Accounts: The attacker used the stolen credentials to log into the email account.
• T1114.001 - Local Email Collection: The attacker searched the compromised mailbox for sensitive data.
• T1041 - Exfiltration Over C2 Channel: The attacker likely forwarded emails or downloaded attachments to an external location.

Impact Assessment

The impact on the affected patients and employees is extremely high. The combination of PII, PHI, and financial data is a complete toolkit for identity theft, financial fraud, and sophisticated social engineering attacks. Patients could be targeted by scams related to their specific medical conditions, which can be highly effective and distressing. Under HIPAA, HCCI faces a significant regulatory burden, including potential fines from the Department of Health and Human Services (HHS) and legal action. The law firm Wolf Haldenstein has already announced an investigation into claims on behalf of victims, indicating the likelihood of class-action lawsuits.

IOCs — Directly from Articles

No specific technical indicators of compromise were provided in the source articles.

Cyber Observables — Hunting Hints

To detect similar email account compromises, organizations should hunt for:

• Log Source: Microsoft 365 or Google Workspace audit logs, email gateway logs.
• Anomalous Logins: Logins to email accounts from unfamiliar IP addresses, geographic locations, or user agents. Look for impossible travel scenarios.
• New Mail Rules: Creation of new inbox rules that forward emails to external addresses or delete security notifications.
• Mass Data Access: A single account accessing or downloading an unusually large number of emails or attachments in a short period.

Detection & Response

• MFA on Email: Enforce multi-factor authentication on all email accounts. This is the single most effective control against credential compromise from phishing.
• Email Security Gateway: Use an advanced email security solution to block phishing emails before they reach users.
• Log Monitoring: Actively monitor email platform audit logs for the suspicious activities listed above. Use a SIEM to correlate login data and set up alerts for anomalies. This aligns with D3-DAM: Domain Account Monitoring.

Mitigation

• User Training: Regularly train users to identify and report phishing emails (M1017 - User Training).
• Multi-Factor Authentication (MFA): Implement phishing-resistant MFA (e.g., FIDO2) for all user accounts, especially those with access to sensitive data (M1032 - Multi-factor Authentication).
• Data Loss Prevention (DLP): Implement DLP policies for email to detect and block the unauthorized exfiltration of sensitive data like PHI and SSNs.
• Limit Data in Email: Establish policies and technical controls to minimize the storage of sensitive PHI and PII within email accounts. Use secure, dedicated systems for patient records.