County of Los Angeles Department of Public Health

Los Angeles County Department of Health Services filed a breach notification with the California OAG. The date of breach listed is February 6, 2024. The consumer notification letter attachment could not be extracted (pages returned empty). Minimal details are available from the filing page alone.

Los Angeles County Dept of Public Health experienced a phishing attack between Feb 19-20, 2024, where an external actor gained credentials for 53 employees via a malicious link. Compromised data may include names, DOB, SSN, diagnoses, prescriptions, medical record numbers, and insurance info. DPH disabled accounts, reset devices, and offered one year of identity monitoring via Kroll. Law enforcement was notified.

County of Los Angeles Departments of Health Services and Public Health reported to HHS on 2024-04-25 a Hacking/IT Incident (email phishing scheme) affecting 252,856 individuals. Multiple employees were targeted via phishing, exposing PHI including names, addresses, dates of birth, driver's license and Social Security numbers, financial information, diagnoses, conditions, lab results, medications, and other treatment information. Breached information located on Email. The CE notified affected individuals, media, and HHS, and offered credit monitoring. Staff were retrained on email security and additional technical safeguards were implemented.

Los Angeles County Department of Health Services experienced a phishing attack between February 19-20, 2024, where hackers obtained login credentials for 23 employee email accounts via malicious links. Compromised data included names, dates of birth, addresses, phone numbers, email addresses, medical record numbers, and health information (diagnoses, treatments, medications). SSNs and financial information were not involved. DHS disabled accounts, reset devices, blocked phishing sites, and notified law enforcement and regulators (CDPH, HHS OCR).

County of Los Angeles Department of Public Health disclosed a data breach involving the unauthorized public posting of Mobile Food Facility Official Inspection Reports on its Environmental Health Division website. The reports, posted between July 1, 2020, and July 29, 2022, contained individuals' names and driver's license or identification numbers. The agency removed the reports and provided additional staff training.