County of Los Angeles Department of Mental Health

Los Angeles County Department of Mental Health experienced a phishing incident on May 28, 2024, where employees interacted with a malicious email from a trusted partner, leading to compromised Microsoft Office 365 accounts. The breach potentially exposed names, SSNs, DOBs, addresses, phone numbers, medical record numbers, health insurance info, diagnoses, and treatment information. The organization disabled accounts, reset credentials, engaged forensic specialists, and notified law enforcement and Microsoft.

County of Los Angeles Department of Mental Health reported to HHS on 2024-09-05 a Hacking/IT Incident (email phishing attack) affecting 2,334 individuals. An employee was targeted via phishing, compromising PHI including names, addresses, dates of birth, Social Security numbers, and treatment information. Breached information was located on Email. The CE notified HHS, affected individuals, and media, and responded by implementing additional technical safeguards and retraining staff.

Affected (this filing): 2,334