NOW Health Group, Inc.

The Maine Office of the Attorney General disclosed a data breach affecting NOW Health Group, Inc., which took place between March 17 and March 20, 2023. Unauthorized actors gained access to employee email accounts, exposing sensitive personal information, including individuals' names and Social Security numbers. The incident impacted 4,661 individuals, raising concerns over potential identity theft, financial fraud, or misuse of compromised data. The breach highlights vulnerabilities in email security protocols, emphasizing the need for stronger access controls and monitoring to prevent similar intrusions. While the exact method of unauthorized access remains undisclosed, the exposure of Social Security numbers highly valuable for fraudulent activities poses significant long-term risks for affected individuals. The company has not publicly detailed mitigation measures or whether the compromised data was exfiltrated or merely accessed.

Source: https://www.maine.gov/agviewer/content/ag/985235c7-cb95-4be2-8792-a1252b4f8318/5b8cac86-8526-4951-817c-387ea2fcc6f3.shtml

TPRM report: https://www.rankiteo.com/company/nowfoodscanada

"id": "now028090625",
"linkid": "nowfoodscanada",
"type": "Breach",
"date": "3/2023",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"

{'affected_entities': [{'customers_affected': '4,661 individuals',
                        'name': 'NOW Health Group, Inc.',
                        'type': 'Company'}],
 'attack_vector': 'Unauthorized Access (Email Compromise)',
 'data_breach': {'number_of_records_exposed': '4,661',
                 'personally_identifiable_information': ['Name',
                                                         'Social Security '
                                                         'Number'],
                 'sensitivity_of_data': 'High (includes SSN)',
                 'type_of_data_compromised': ['Personally Identifiable '
                                              'Information (PII)']},
 'date_publicly_disclosed': '2023-09-05',
 'description': 'The Maine Office of the Attorney General reported a data '
                'breach involving NOW Health Group, Inc. on September 5, 2023. '
                'The breach, which occurred between March 17 and March 20, '
                '2023, involved unauthorized access to employee email '
                'accounts, potentially compromising sensitive information '
                "including an individual's name and Social Security number, "
                'and affecting a total of 4,661 individuals.',
 'impact': {'data_compromised': ['Name', 'Social Security Number'],
            'identity_theft_risk': 'High (SSN exposed)',
            'systems_affected': ['Employee Email Accounts']},
 'initial_access_broker': {'entry_point': 'Employee Email Accounts'},
 'references': [{'date_accessed': '2023-09-05',
                 'source': 'Maine Office of the Attorney General'}],
 'regulatory_compliance': {'regulatory_notifications': ['Maine Office of the '
                                                        'Attorney General']},
 'response': {'communication_strategy': 'Public disclosure via Maine Office of '
                                        'the Attorney General'},
 'title': 'Data Breach at NOW Health Group, Inc.',
 'type': 'Data Breach'}