The covered entity (CE), Connecticut Department of Social Services, reported that numerous employees were the victims of an email phishing attack that affected the electronic protected health information (ePHI) of 36,915 individuals. The ePHI involved included names, Social Security numbers, addresses, dates of birth, diagnoses/conditions, medication information, lab results, and claims and financial information. The CE notified HHS, affected individuals, and the media. In response to the breach, the CE implemented additional technical safeguards and retrained its employees on email security.
