County of Los Angeles Department of Mental Health

Los Angeles County Department of Mental Health notified the CA AG of a breach stemming from a cyber-attack on the Department of Children's and Family Services (DCFS) on Oct 17, 2023. Attackers used MFA push notification spamming to access a DCFS employee's Microsoft 365 account, then leveraged email exchanges to compromise a DMH employee's account. Affected data includes names, DOBs, SSNs, addresses, phone numbers, medical record numbers, health insurance info, diagnoses, and treatment info. DMH disabled accounts, reset credentials, engaged forensics, and implemented new security controls.

County of Los Angeles Department of Mental Health reported to HHS on 2023-12-22 a Hacking/IT Incident affecting 1,284 individuals. An employee was targeted by an email phishing scheme that compromised PHI stored on a network server. Exposed data included names, addresses, dates of birth, Social Security numbers, and treatment information. The CE notified affected individuals, the media, and HHS, provided substitute notice and credit monitoring, and retrained staff on email security.

Affected (this filing): 1,284