Philadelphia City Reveals Personal Data Was Compromised in May Email Hack

On October 20, 2023, the City of Philadelphia disclosed a security incident, wherein unknown threat actors had gained access to the city’s email accounts containing personal information of several individuals.

The breach was first discovered on May 24, 2023, when officials noticed suspicious activity in the city’s email environment. Following which, an investigation in partnership with third-party cybersecurity vendors was conducted. The ongoing investigation revealed that for two months since the first breach discovery, unauthorized actors may have not only gained access to compromised email accounts but also the information within it.

‘’We launched an investigation, [..]. However, to date, the investigation determined that between May 26, 2023, and July 28, 2023, an unauthorized actor may have gained access to certain city email accounts and certain information contained therein,’’ the notice states.

The ongoing investigation on August 22 further revealed that the compromised account may have contained protected healthcare information of the said individuals.

According to city officials, the stolen information which may vary by individual but could include demographic information like, names, address, date of birth, social security number, and other contact information. In addition it could include, health data like diagnosis and other treatment-related information, limited financial data, and claims information.

In the notice, the city also stated that upon confirmation of identity and contact information, impacted individuals would be notified via city officials. Moreover, it also revealed the implementation of several mitigation measures to prevent similar incidents in the future, including reporting the incident to the U.S. Department of Health and Human Services.

‘’As part of our ongoing commitment to information security, we are also reviewing our existing policies and procedures, implementing additional administrative and technical safeguards to further secure information in our care, and providing additional training on how to safeguard information in our email environment,’’ the notice continued.

Moreover, impacted individuals have been advised to stay vigilant and report any suspicious activity to concerned healthcare and financial organizations.