Alcare: work phone account taken over

An employee entered Apple Account credentials into an SMS-linked phishing site on December 1; account changes and a phone reset were discovered the next day. About 200 medical/distributor contacts and 400 staff contacts were potentially exposed. Patient/general-public data was excluded. Account recovery failed and notification and investigation continued. The notice explicitly excludes leakage of email addresses.