Recently, the Los Angeles County Department of Health Services announced that a phishing attack in February led to a hacker obtaining login credentials of an employee, potentially compromising the personal information of approximately 47,000 individuals. The attack occurred on February 6th and once discovered, the department took immediate action by disabling the impacted email account, resetting and re-imaging the user’s devices, blocking suspicious websites related to the attack and quarantining all suspicious incoming emails.
The potentially compromised email account contained sensitive information such as full names, dates of birth, home addresses, phone numbers, email addresses, Social Security numbers, government-issued IDs, medical record numbers and health insurance information. The impacted individuals are being notified by mail and a notice is posted on the department’s website for those without mailing addresses. The Department of Health & Human Services’ Office for Civil Rights and other necessary agencies have also been informed as per legal requirements.
To address concerns and reduce the risk of similar attacks in the future, DHS has already made enhancements to their email security protocols. While they cannot confirm if the compromised information has been misused; affected individuals are encouraged to review their medical records with their healthcare provider. To further assist affected individuals in restoring their identity theft protection services are enlisted from an identity monitoring service that will provide credit monitoring, fraud consultation and assistance with identity theft restoration.
In another incident reported by L.A county Department of Public Health , a phishing attack in February affected 53 employees leading to compromise of personal information of over 200 thousand individuals .
