Los Angeles Public Health Department Discloses Large Data Breach

Los Angeles County Department of Public Health (DPH) has disclosed a data breach impacting  more than 200,000 individuals.

The data stolen includes personal, medical and financial information.

The incident, which took place between February 19 and 20, 2024, was caused by an attacker gaining the log-in credentials of 53 Public Health employees through a phishing email.

The local government department, which serves the approximately 10 million residents of LA County, said the information identified in the compromised email account may have included the following DPH clients/employees/other individuals’ data:

• First and last name and date of birth
• Diagnosis and prescription information
• Medical record number/patient ID
• Medicare/Med-Cal number
• Health insurance information
• Social security number and other financial information

Affected individuals may have been impacted differently and not all of the elements listed were present for each individual.

All potentially impacted individuals are being notified by post. For those where a mailing address is not available, Public Health is also posting a notice on its website to provide information and resources.

The DPH said: “While Public Health cannot confirm whether information has been accessed or misused, individuals are encouraged to review the content and accuracy of the information in their medical record with their medical provider.”

Impacted individuals are also being offered one year of free identity monitoring from Kroll.

Law enforcement has investigated the incident and the US Department of Health and other agencies are being notified as required by law and/or contract.

Incident Caused by Phishing Attack

The DPH said it has implemented “numerous enhancements” to its security posture to prevent similar phishing attacks occurring in the future.

Upon discovering the attack, the department disabled impacted email accounts and reset and re-imaged the users’ devices.

Additionally, all websites that were identified as part of the phishing campaign were blocked and all suspicious incoming emails quarantined.

The health service added that it has distributed awareness notifications to all workforce members to remind them to be vigilant when reviewing emails, especially those including links or attachments.

On June 12, it was revealed that US private healthcare provider Ascension was compromised by ransomware attackers after an employee accidently downloaded a malicious file.

The incident led to ambulances being diverted and patient appointments postponed, and it is believed the attackers stole files containing protected health information (PHI) and personally identifiable information (PII) of patients.

Read here: Millions of Americans’ Data Potentially Exposed in Change Healthcare Hack