New York Psychotherapy and Counseling Center (NYPCC), a non-profit, community-oriented mental health organization suffered from a data Security Incident that patients information.
NYPCC learned that an unauthorised third party had gained access to a computer system at headquarters.
In order to stop additional illegal access to the data on servers, they immediately secured it.
They hired a forensic cybersecurity company from outside to look into the scope of the problem.
The NYPCC also informed the NYS Attorney General's office, law enforcement, and the US Department of Health and Human Services.
The compromised information includes patients' personal health information, including name, dates of service, address, Medicaid ID and date of birth.
NYPCC offered complimentary identity monitoring, credit monitoring and other related services to individuals whose personal information have been impacted.
Source: https://finance.yahoo.com/news/notice-data-security-incident-210000485.html?guccounter=1
TPRM report: https://scoringcyber.rankiteo.com/company/nypcc-new-york-psychotherapy-counseling-center
"id": "new1148101122",
"linkid": "nypcc-new-york-psychotherapy-counseling-center",
"type": "Breach",
"date": "11/2021",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Mental Health',
'location': 'New York',
'name': 'New York Psychotherapy and Counseling Center',
'type': 'Non-Profit'}],
'attack_vector': 'Unauthorized Access',
'data_breach': {'personally_identifiable_information': ['Name',
'Address',
'Medicaid ID',
'Date of Birth'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personal Health Information']},
'description': 'NYPCC, a non-profit mental health organization, suffered a '
'data security incident where an unauthorized third party '
'gained access to a computer system at their headquarters.',
'impact': {'data_compromised': ['Name',
'Dates of Service',
'Address',
'Medicaid ID',
'Date of Birth'],
'identity_theft_risk': 'High',
'systems_affected': ['Computer System at Headquarters']},
'initial_access_broker': {'entry_point': 'Computer System at Headquarters'},
'investigation_status': 'Ongoing',
'references': [{'source': 'Cyber Incident Description'}],
'regulatory_compliance': {'regulatory_notifications': ['NYS Attorney '
"General's office",
'US Department of '
'Health and Human '
'Services']},
'response': {'communication_strategy': ["Informed NYS Attorney General's "
'office',
'Informed US Department of Health and '
'Human Services'],
'containment_measures': 'Secured the computer system',
'enhanced_monitoring': ['Complimentary identity monitoring',
'Credit monitoring'],
'incident_response_plan_activated': True,
'law_enforcement_notified': True,
'third_party_assistance': 'Forensic Cybersecurity Company'},
'threat_actor': 'Unauthorized Third Party',
'title': 'Data Security Incident at New York Psychotherapy and Counseling '
'Center',
'type': 'Data Breach'}