County of Los Angeles Department of Public Health

County of Los Angeles Departments of Health Services and Public Health reported to HHS on 2024-04-25 a Hacking/IT Incident (email phishing scheme) affecting 252,856 individuals. Multiple employees were targeted via phishing, exposing PHI including names, addresses, dates of birth, driver's license and Social Security numbers, financial information, diagnoses, conditions, lab results, medications, and other treatment information. Breached information located on Email. The CE notified affected individuals, media, and HHS, and offered credit monitoring. Staff were retrained on email security and additional technical safeguards were implemented.

Affected (this filing): 252,856

Los Angeles County Department of Health Services experienced a phishing attack between February 19-20, 2024, where hackers obtained login credentials for 23 employee email accounts via malicious links. Compromised data included names, dates of birth, addresses, phone numbers, email addresses, medical record numbers, and health information (diagnoses, treatments, medications). SSNs and financial information were not involved. DHS disabled accounts, reset devices, blocked phishing sites, and notified law enforcement and regulators (CDPH, HHS OCR).