CO: Hackers tap into medical group’s records after employees fall for phishing attempt