M&T Bank

The business associate (BA), M&T Bank, reported that an employee was the victim of a social engineering attack the compromised the protected health information (PHI) of 5,878 individuals. The PHI involved includes names, addresses, financial and health insurance information, diagnoses, medications prescribed, Social Security numbers, drivers’ license numbers, and other treatment information. The BA notified HHS, affected individuals, and the media. In response to the breach, the BA implemented additional administrative and technical safeguards and retrained its staff on fraud and identity theft prevention.