Social EngineeringHealthcareGovernmentHealthcarePhishingStolen CredentialsCustomer Data InvolvedEmployee Data InvolvedIdentity (basic)Government IDPHIHealth (basic)Financial accountMediumContained

County of Los Angeles Department of Mental Health

bd_70c0fd0ad8b69391 · schema v1 · pii pii-v1

Severity

Medium

Discovered

May 28, 2024

Filed

Aug 30, 2024

To disclose

13 weeks

Affected

Not disclosed

Linked

2 filings

Confidence

66%

Full breach record for County of Los Angeles Department of Mental Health →7 incidents on file

Los Angeles County Department of Mental Health experienced a phishing incident on May 28, 2024, where employees interacted with a malicious email from a trusted partner, leading to compromised Microsoft Office 365 accounts. The breach potentially exposed names, SSNs, DOBs, addresses, phone numbers, medical record numbers, health insurance info, diagnoses, and treatment information. The organization disabled accounts, reset credentials, engaged forensic specialists, and notified law enforcement and Microsoft.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 1 days

discovery → filing · 13 weeks / 94 days

May 27, 2024

Begins

May 28, 2024

Discovered

Aug 30, 2024

Filed

vs. sector median

+1 wks slower

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Regulatory filings (1) · sorted by filing gap

HHS OCRbd_8070af4059f69d7b2024-09-05 · +6dVerified

Name: County of Los Angeles Department of Mental Health
norm: county of los angeles department of mental health

Name: County of Los Angeles Department of Mental Health
norm: county of los angeles department of mental health
Industry: HealthcarellmGovernmentllm

Discovered: May 28, 2024
Breach occurred: May 27, 2024
Undetected for: 1 dayoccurrence → discovery
Materiality determined: —
Notification sent: —
Affected individuals: Not disclosed
Data types: Identity (basic)Government IDPHIHealth (basic)Financial account
Data elements: Social Security numberDate of birthMedical information
Attack vector: Phishing
MITRE ATT&CK: T1566.002 Spearphishing LinkT1078 Valid AccountsT1114 Email Collection
Threat actor: External
Initial access: phishing_link

During the incident: Disabled the impacted accounts
Reset the Microsoft Office 365 and multi-factor authentication credentials
Notified law enforcement and cooperated with law enforcement’s investigation
Initiated a comprehensive review, with the assistance of industry leading forensic specialists, to identify any personally identifying information or personal health information in the impacted accounts
Notified Microsoft of the vulnerability in the Microsoft Office 365 multi-factor authentication that was exploited by the malicious actor or actors
Changes made: Reviewing and updating security policies, procedures, and controls
Implemented new security controls to address this specific attack
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 13 weeks(94 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 2 filings

View merged incident ↗

California State AGAug 30 · first · this page

HHS OCR+6d

Pattern: first filing Aug 30 (CA), last Sep 5 (CA) — a 6-day rolling notification. Rolling spreads often mean counsel is filing as thresholds trip per state. Why this link?

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://oag.ca.gov/ecrime/databreach/reports/sb24-591079
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Aug 30, 2024
Raw hash: ed4287e95fb2320f14cee281b29160e4bb8f4b495f723217271412a23bfc06b2

Linked disclosures

Regulatory filings (1) · sorted by filing gap

Reporting entityCounty of Los Angeles Department of Mental Health

Victim entityCounty of Los Angeles Department of Mental Health

Incidentdiscovered May 28, 2024

Stated responseDisabled the impacted accounts

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenanceoag.ca.gov