Phisherman Hooked 108 LA County Health Department Workers Resulting in Breach of 750,000

Well, better late than never, as the saying goes. At least that is the belief of officials at Los Angeles County, who announced an attack that resulted in the access of health data and/or personal information of more than 750,000 people. The incident actually occurred over seven months prior to the announcement, yet the Department of Health Services knew of the attack the day after it occurred. They cited an exemption in the laws of California that allowed them to delay notification to the public in favor of protecting an ongoing investigation.

Information accessed via a phishing attack included names, addresses, birth dates, social security numbers, medical information including diagnoses and treatment information, and financial information. In addition, a smaller amount of confidential information from more than 12 other county departments was compromised in this incident. Those affected are being notified and are being offered one year of free credit and identity theft monitoring services. Anyone who receives a notice should take advantage of this.

While these types of services will not prevent identity theft or fraud of any sort, they will alert you when something suspicious occurs related to your information. In addition, if you have no need to obtain credit, consider putting a freeze on your credit report. This will prevent anyone from accessing it and potentially opening credit accounts in your name.

Credit freezes block any attempt to access your credit and if your social security number has been compromised, it’s not a bad idea to freeze your credit if that is a reasonable option. You can always temporarily lift it if needed. Just make sure to check the details when starting this. There may be lag time before it can be removed or other conditions; possibly even charges.

The cyber thief was able to trick 108 county employees into providing information such as user names and passwords. Phishing is still the most common way that breaches occur and how malware ends up on devices or roaming around networks. Always pay attention to email messages and don’t click links or attachments that arrive in unsolicited or unexpected email messages, whether at work or at home.

It is understandable that we may be in a hurry to get through the barrage of email every day. In fact, a study by Proofpoint released in 2015 found that middle managers have double or triple the “click-through” rate of other employees, likely due to the fact that they receive double or triple the number of messages as other employees. It adds additional time pressure to get through them, so they rush and mistakes can occur. However, taking a little bit of extra time could save a lot of heartache and money for you and the organization. Regardless of what position in the company you hold, patience can pay off in spades when it comes to phishing attacks.

An unusual twist to this story is that that someone is actually being charged for this attack. A 37 year-old man was charged with nine felony counts, including identity theft.