Tempe Health Firm Falls Victim to Phishing Scam, Accidentally Exposes Clients in Alert Email

A Tempe-based behavioral health company, Crisis Preparation and Recovery Inc., recently fell victim to a phishing attack. This incident resulted in an email sent from a compromised account that inadvertently exposed client information, according to reports from the Arizona Mirror.

On June 23, clients received a spam email titled “Request for Proposal,” prompting concerns. The attack was identified by the company’s IT team, which later issued a warning about the malicious links contained in the email.

Phishing is a tactic where attackers deceive individuals into revealing sensitive information, such as usernames and passwords, often via malicious email links. Once obtained, scammers can access personal data like credit card or banking details through these credentials.

In an unexpected turn, the follow-up warning email from CPR unintentionally revealed the email addresses of other external recipients, raising additional concerns about privacy. A spokesperson for CPR stated, “While we are aware of the phishing attempt, our legal and compliance teams have confirmed that there was no HIPAA breach.” The organization has pledged to inform clients should the situation change.

Federal law mandates that any company handling HIPAA-related information must notify the Department of Health and Human Services within 60 days of a breach, particularly if it affects over 500 individuals. Queries regarding the number of impacted clients remain unanswered.

CPR has since secured the compromised account and strengthened its internal email security protocols. They also conducted additional cybersecurity training for employees to prevent future incidents. In its communication, CPR advised clients to permanently delete the suspicious emails and change their passwords.

Amid these events, CPR has been in the news for plans to close two outpatient clinic facilities and lay off 73 employees. The Office of Health and Human Services Office of Civil Rights did not respond to a request for comment regarding this breach.

Individuals who believe they may have been affected by the incident are encouraged to file a complaint with HHS OCR.