Seneca Family of Agencies

13 filings across 4 jurisdictions · Oct 26, 2021 – Jan 22, 2022 · 3 milestones

1. Breach window

   Aug 25, 2021 → Aug 27, 2021

   When the intrusion reportedly occurred, per the linked filings

2. Breach discoveredAG web form

   Aug 27, 2021

   Reported by CALIFORNIA AG, WASHINGTON AG filings

3. 60 days
   🐻CALIFORNIAHHS OCRFirst filinglinked via same-victim cross-source · 100%

   Filed Oct 26, 2021bd_730ae92091247265

   Seneca Family of Agencies reported to HHS on 2021-10-26 a Hacking/IT Incident affecting 3900 individuals. Breached information located on Network Server. The cyber-attack affected protected health information (PHI) including names, DOB, SSN, addresses, phone, email, medical record numbers, diagnoses, insurance, prescription, and driver's license data. The entity notified HHS, individuals, and media, provided substitute notice, complimentary credit monitoring, and implemented additional administrative and technical safeguards.

4. 🐻California State AGlinked via same-victim cross-source · 100%

   Filed Oct 26, 2021bd_7453297f49b0c8c5

   Seneca Family of Agencies, a California-based social services provider, disclosed a data breach occurring between August 25 and 27, 2021. Unauthorized access to network files resulted in the potential exposure of names, government IDs, and minor children's information. The organization reported the incident to law enforcement, engaged computer specialists, and provided 12 months of credit monitoring via Equifax to affected individuals. No evidence of misuse was found, but access could not be ruled out.

5. 🐻CALIFORNIAHHS OCRlinked via same-victim cross-source · 100%

   Filed Nov 5, 2021bd_6b715cdc64a845b0

   Seneca Family of Agencies reported to HHS on 2021-11-05 a Hacking/IT Incident affecting 27,309 individuals. Breached information located on Network Server. The business associate experienced a ransomware attack that compromised the protected health information (PHI) of 27,309 individuals. The PHI involved included names, dates of birth, Social Security numbers, addresses, phone numbers, email addresses, medical record numbers, diagnoses, health insurance information, prescription information, drivers’ license/state identification numbers, and other treatment information. The BA notified HHS, affected individuals, the media, and posted substitute notice on its website. In response to the breach, the BA implemented additional administrative and technical safeguards to better protect PHI.

   Affected (this filing):

6. 8 State AG filingsNov 5, 2021 – Dec 6, 2021ExpandCollapse

   CAWAMTME

   🐻California State AGlinked via same-victim cross-source · 100%
7. Breach discoveredconflicts with Aug 27, 2021

   Nov 12, 2021

   Reported by MAINE AG filing

8. 70 days
   🐻California State AGlinked via same-victim cross-source · 100%

   Filed Jan 21, 2022bd_e6c8e1020598d980

   Seneca Family of Agencies reported a data breach where unauthorized access to its network occurred between August 25-27, 2021. The incident impacted data for individuals receiving services from Community Health for Asian Americans (CHAA). Data accessed included names and other identifiers for adults and minors. Seneca notified law enforcement, engaged computer specialists, and provided 12 months of credit monitoring and identity protection services through Equifax to affected individuals.
9. 🐻CALIFORNIAHHS OCRMost recentlinked via same-victim cross-source · 100%

   Filed Jan 22, 2022bd_8eab077bfd6678fc

   Seneca Family of Agencies reported to HHS on 2022-01-22 a Hacking/IT Incident affecting 1528 individuals. Breached information located on Network Server. The covered entity experienced a cyber-attack affecting the protected health information (PHI) of 1,528 individuals. The PHI involved included names, dates of birth, Social Security numbers, addresses, phone numbers, email addresses, medical record numbers, diagnoses, health insurance information, prescription information, drivers’ license/state identification numbers, and other treatment information. The CE notified HHS, affected individuals, the media, and provided substitute notice. In its mitigation efforts, the CE provided complimentary credit monitoring services and implemented additional administrative and technical safeguards.