Coordinated Care Services, Inc.

The Maine Office of the Attorney General disclosed a data breach at Coordinated Care Services, Inc. in June 2022, stemming from unauthorized access to an employee’s email account between March 10 and March 21, 2022. The incident exposed personal information of 212 individuals, including names and dates of birth, though Social Security numbers were not compromised. Only 2 Maine residents were specifically affected. The breach resulted from a targeted intrusion into the employee’s email, likely via phishing or credential theft, leading to the exposure of sensitive but non-financial personal data. While the scope was limited to basic identifiers, the incident highlights vulnerabilities in email security and the risks of third-party access to employee accounts. No evidence of further misuse (e.g., identity theft or financial fraud) was reported, but the exposure of personal details could still pose reputational and privacy risks for the affected individuals and the organization.

Source: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/64b70715-7d59-445a-934f-f36fb50b4f51.shtml

TPRM report: https://www.rankiteo.com/company/ccsi_3

"id": "ccs038091825",
"linkid": "ccsi_3",
"type": "Breach",
"date": "3/2022",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'customers_affected': 212,
                        'industry': 'Healthcare',
                        'location': 'Maine, USA',
                        'name': 'Coordinated Care Services, Inc.',
                        'type': 'Healthcare Services Provider'}],
 'attack_vector': 'Unauthorized access to employee email account',
 'data_breach': {'number_of_records_exposed': 212,
                 'personally_identifiable_information': ['Names',
                                                         'Dates of birth'],
                 'sensitivity_of_data': 'Moderate (names, dates of birth; no '
                                        'SSNs)',
                 'type_of_data_compromised': ['Personal Information']},
 'date_detected': '2022-03-21',
 'date_publicly_disclosed': '2022-06-14',
 'description': 'The Maine Office of the Attorney General reported a data '
                'breach involving Coordinated Care Services, Inc. on June 14, '
                '2022. The breach occurred between March 10 and March 21, '
                "2022, due to unauthorized access to an employee's email "
                'account, affecting 212 individuals in total, with 2 residents '
                'specifically impacted. The incident involved personal '
                'information including names and dates of birth, but did not '
                'include Social Security numbers.',
 'impact': {'data_compromised': ['Names', 'Dates of birth'],
            'identity_theft_risk': 'Low (no SSNs compromised)',
            'systems_affected': ['Employee email account']},
 'initial_access_broker': {'entry_point': 'Employee email account'},
 'references': [{'date_accessed': '2022-06-14',
                 'source': 'Maine Office of the Attorney General'}],
 'regulatory_compliance': {'regulatory_notifications': ['Maine Office of the '
                                                        'Attorney General']},
 'response': {'communication_strategy': 'Public disclosure via Maine Office of '
                                        'the Attorney General'},
 'title': 'Data Breach at Coordinated Care Services, Inc.',
 'type': 'Data Breach'}