Covenant Care California, LLC

The California Office of the Attorney General disclosed a data breach at Covenant Care California, LLC, where an unauthorized party gained access to an employee’s email account between January 22, 2019, and January 29, 2019. The incident exposed sensitive personal information of 7,585 California residents, including names, Social Security numbers, and medical records. The breach was identified after the unauthorized access, and notifications were issued to affected individuals on March 6, 2019. The compromised data poses significant risks, such as identity theft, financial fraud, and potential misuse of medical records. While the breach was limited to a single email account, the nature of the exposed information particularly Social Security numbers and medical details heightens the severity. The company likely faced regulatory scrutiny under California’s data protection laws, including potential penalties for failing to safeguard sensitive data. The incident underscores vulnerabilities in email security protocols and the critical need for robust access controls, monitoring, and employee training to prevent similar breaches in healthcare organizations, where patient confidentiality is paramount.

Source: https://oag.ca.gov/ecrime/databreach/reports/sb24-145240

TPRM report: https://www.rankiteo.com/company/covenant-care

"id": "cov947091725",
"linkid": "covenant-care",
"type": "Breach",
"date": "1/2019",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"

{'affected_entities': [{'customers_affected': '7,585',
                        'industry': 'Healthcare',
                        'location': 'California, USA',
                        'name': 'Covenant Care California, LLC',
                        'type': 'Healthcare Provider'}],
 'attack_vector': 'Unauthorized Access (Email Account Compromise)',
 'customer_advisories': 'Notifications sent to affected individuals on March '
                        '6, 2019',
 'data_breach': {'data_exfiltration': 'Likely (unauthorized access to email '
                                      'account)',
                 'number_of_records_exposed': '7,585',
                 'personally_identifiable_information': ['Names',
                                                         'Social Security '
                                                         'Numbers'],
                 'sensitivity_of_data': 'High',
                 'type_of_data_compromised': ['Personally Identifiable '
                                              'Information (PII)',
                                              'Protected Health Information '
                                              '(PHI)']},
 'date_detected': '2019-01-29',
 'description': 'The California Office of the Attorney General reported that '
                'Covenant Care California, LLC experienced a data breach '
                'involving unauthorized access to an employee email account '
                'between January 22, 2019 and January 29, 2019. The breach '
                'potentially affected the personal information of 7,585 '
                'California residents, including names, Social Security '
                'numbers, and medical records.',
 'impact': {'data_compromised': ['Names',
                                 'Social Security Numbers',
                                 'Medical Records'],
            'identity_theft_risk': 'High (PII and medical data exposed)',
            'systems_affected': ['Employee Email Account']},
 'initial_access_broker': {'entry_point': 'Employee Email Account'},
 'references': [{'source': 'California Office of the Attorney General'}],
 'regulatory_compliance': {'regulations_violated': ['California Data Breach '
                                                    'Notification Law (likely)',
                                                    'HIPAA (potentially)'],
                           'regulatory_notifications': ['California Office of '
                                                        'the Attorney '
                                                        'General']},
 'response': {'communication_strategy': 'Notifications sent to affected '
                                        'individuals on March 6, 2019'},
 'title': 'Covenant Care California, LLC Data Breach (2019)',
 'type': 'Data Breach'}