An international law firm assists businesses impacted by security events has experienced a cyberattack, where it compromised the sensitive health information of hundreds of thousands of data breach victims.
Orrick, Herrington & Sutcliffe, the San Francisco-based company revealed last week that that during an attack in March 2023, threat actors stole personal information and critical health data of more than 637,000 data breach victims.
Orrick said that the hackers had taken massive amounts of data from its systems related to security incidents at other organizations, for which he provided legal assistance, in a series of letters notifying those impacted of the data breach.
Orrick informs that the data involved in the breach involved its customers' data, including those with dental policies with Delta Dental, a major healthcare insurance network that covers millions of Americans' dental needs, and those with vision plans with insurance company EyeMed Vision Care.
The company further added that it had contacted with the U.S. Small Business Administration, the behavioral health giant Beacon Health Options, and the health insurance provider MultiPlan that their data was also exposed in Orrick's data breach.
Apparently, the stolen data includes victims' names, dates of birth, postal address and email addresses, and government-issued identification numbers, such as Social Security numbers, passport and driver license numbers, and tax identification numbers.
Information about patient's medical treatment and diagnosis details, insurance claim like date and service-charges, and healthcare insurance numbers and provider details have been compromised.
Orrick further says that credit or debit card details as well as online account credentials were also involved in the breach.
Since the initial announcement of the breach, the number of affected individuals have been on the rise.
Orrick said in December to a federal court in San Francisco that it reached a preliminary settlement to end four class action lawsuits that claimed Orrick failed to disclose the breach from victims for months after it had occurred.
This Cyber News was published on www.cysecurity.news. Publication date: Mon, 08 Jan 2024 14:13:05 +0000