Privacy Concerns in Philadelphia: City Announces Data Breach from May 2023

Category: Data Breach | Industry: Government | Source: Phila.Gov

The City of Philadelphia has disclosed a security event on October 20th, 2023 that may impact the security of individuals' information. According to the city's released privacy incident notice, the incident was initially discovered on May 24th, 2023, based on the identification of "suspicious activity in its email environment," triggering an investigation with third-party cybersecurity experts. The notice mentions the investigation is still "ongoing." However, it is revealed that between May 26th, 2023, and July 28th, 2023, an unauthorized user was able to obtain access to certain email accounts. In addition, it was learned on August 22nd, 2023, the city became aware that “the at-issue email accounts include email accounts that may contain protected health information," the notice says.

While the city is continuing its investigation and the extent of its data impact, the city is warning individuals that information pertaining to their "demographic information, such as name, address, date of birth, social security number, and other contact information; medical information, such as diagnosis and other treatment related information; and limited financial information, such as claims information," maybe at risk. As a result of this incident, the City of Philadelphia has assured they have taken immediate measures to enhance the security of its systems and email environment. They are also conducting a review of their existing policies, implementing additional safeguards, and providing training to safeguard information in the email environment.

The incident has been reported to the U.S. Department of Health and Human Services, and further reporting to relevant regulators is underway. Affected individuals are encouraged to remain vigilant against potential identity theft, reviewing account statements, credit reports, and explanations of benefits for unusual activity and promptly reporting any suspicious activity to the appropriate authorities and institutions.