The California Department of Corrections and Rehabilitation (CDCR) suffered a data breach that affected the medical information of everyone who was tested for COVID-19 by the department from June 2020 through January 2022.
CDCR discovered some suspicious activity in a file transfer system dating back to December 2021 and took immediate action to suspend the affected system.
They also notified authorities and began a multi-agency investigation.
The exposed information included their name, CDCR number, mental health treatment, mental health history, and mental health diagnosis and also Social Security Numbers, driver’s license numbers, and trust account information.
Source: https://www.cdcr.ca.gov/family-resources/2022/08/22/potential-data-breach-information/
TPRM report: https://scoringcyber.rankiteo.com/company/california-department-of-corrections-and-rehabilitation
"id": "cad20481122",
"linkid": "california-department-of-corrections-and-rehabilitation",
"type": "Breach",
"date": "01/2022",
"severity": "100",
"impact": "6",
"explanation": "Attack threatening the economy of a geographical region"{'affected_entities': [{'industry': 'Corrections and Rehabilitation',
'location': 'California, USA',
'name': 'California Department of Corrections and '
'Rehabilitation',
'type': 'Government Agency'}],
'attack_vector': 'Suspicious activity in a file transfer system',
'data_breach': {'personally_identifiable_information': True,
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Medical information',
'Personal identifiable '
'information']},
'date_detected': 'December 2021',
'description': 'The California Department of Corrections and Rehabilitation '
'(CDCR) suffered a data breach affecting the medical '
'information of individuals tested for COVID-19 from June 2020 '
'through January 2022.',
'impact': {'data_compromised': ['Name',
'CDCR number',
'Mental health treatment',
'Mental health history',
'Mental health diagnosis',
'Social Security Numbers',
'Driver’s license numbers',
'Trust account information'],
'systems_affected': ['File transfer system']},
'investigation_status': 'Multi-agency investigation',
'response': {'containment_measures': 'Suspended the affected system',
'law_enforcement_notified': True},
'title': 'CDCR Data Breach',
'type': 'Data Breach'}