Chiba University: a personal cloud account used by a doctor at its university hospital was taken over by phishing, and data on 586 patients may have leaked

1. 2021-04-25

   The doctor's mobile phone received phishing by SMS posing as a delivery company, so-called smishing, and the ID and password of a cloud service were stolen. The same day the attacker changed the password and other settings, and the doctor could no longer enter the account. [1]

In mid-April, to prepare for a specialist exam, the doctor took data for counting cases home against hospital rules and saved it on a personal PC. The setup synced that data to a cloud service unintentionally. The cloud held names, birth dates, genders, admission and discharge dates, diagnoses, reasons for admission, independence levels and consciousness states of 586 patients, not anonymized. [1]