County of Los Angeles Department of Mental Health

Los Angeles County Department of Mental Health notified individuals that their personal information may have been accessed following a cyberattack on the City of Gardena Police Department on January 22, 2024. Threat actors exploited a multi-factor authentication vulnerability (push notification spam) to access a GPD employee's Microsoft Office 365 account, then used email exchanges to compromise a DMH employee's account. Affected data includes names, dates of birth, SSNs, addresses, phone numbers, and medical record numbers. No evidence of misuse was found. DMH disabled accounts, reset credentials, engaged forensic specialists, and notified Microsoft.