County of Los Angeles Department of Mental Health

On March 20, 2024, the Los Angeles County Department of Mental Health experienced a phishing incident where an employee scanned a QR code from a malicious attachment, granting an external actor access to their Microsoft Office 365 account. The incident potentially exposed personal information including names, dates of birth, SSNs, addresses, phone numbers, medical record numbers, health insurance info, and treatment information. The department disabled affected accounts, reset credentials, engaged forensic specialists, and notified law enforcement and Microsoft. No evidence of data misuse was found.