The Los Angeles County Department of Health Services has disclosed a data breach after a phishing attack targeted several employees. As a result of the attack, personal data and health information were compromised.
This health system is associated with the operation of public hospitals and clinics in Los Angeles County and is the second largest public healthcare system in the US
As breach notifications , an attack that took place in February led to the theft of credentials of 23 employees.
See also: UnitedHealth Group: Confirms data breach and ransom payment
“Between February 19, 2024 and February 20, 2024, DHS experienced a phishing attack. Specifically, a hacker was able to obtain login credentials for 23 DHS employees via a phishing email,” the alerts revealed. The employees clicked on a linkwithin the phishing email. The attacker then stole the login credentials and gained access to accounts.
The documents and emails in the compromised inboxes included patients' personal and health information:
- first and last name, date of birth, home address, telephone number, email address, medical record number, client ID number, dates of service provision
- medical information (e.g. diagnosis/condition, treatment, test results, medications),
- and/or health plan information.
The data breach does not include Social Security Numbers (SSNs) or financial information . Additionally, not all of the above information was leaked for all of the individuals affected.
See also: FTC: Fines Cerebral for data breach
After discovering the data breach, the Los Angeles County Department of Health Services disabled affected email accounts , reset employee devices, and quarantined all suspicious incoming emails. All employees were also notified to be vigilant about potentially suspicious conversations
The health system will also notify the U.S. Department of Health and Human Services' Office of Civil Rights, the California Department of Public Health, and other relevant agencies about the data.
Consequences of a data breach
Patients can face serious consequences from data breaches. Their personal and health data has been exposed, which can lead to breaches of their privacy.
The compromised data could be used to commit fraud or identity theft. The perpetrators could use the information to open new accounts, obtain credit, or commit other illegal activities in the patient's name.
See also: Nexperia: Ransomware attack and data breach
Additionally, the leak can have psychological effects on patients. The loss of privacy and concern about potential consequences can cause stress and anxiety.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
Finally, there could be legal implications for the Los Angeles healthcare system. Patients could seek compensation for the violation of privacy and loss of their personal data.
Source: www.bleepingcomputer.com
