The California Office of the Attorney General disclosed a data breach affecting Desert Physicians Management on June 22, 2023, stemming from an incident detected on April 23, 2023. The breach involved unusual activity on their computer systems, leading to the potential exposure of sensitive patient data, including names, addresses, dates of birth, and health information. While the compromised data did not include Social Security numbers or financial details, the exposure of protected health information (PHI) poses significant privacy and compliance risks under regulations like HIPAA. The breach highlights vulnerabilities in the organization’s cybersecurity defenses, particularly in detecting and mitigating unauthorized access to patient records. Although no financial or identity theft-related data (e.g., SSNs) was exposed, the leak of personal and medical details could still enable targeted phishing, medical identity fraud, or reputational harm for affected individuals. The incident underscores the critical need for healthcare providers to enforce robust monitoring, encryption, and access controls to safeguard patient confidentiality. As a healthcare entity, the breach may also trigger regulatory scrutiny, potential fines, and mandatory notifications to impacted patients, further amplifying operational and financial repercussions.

The California Office of the Attorney General reported on March 8, 2023, a data breach involving Epic Management LLC, which occurred on January 24, 2023. The breach resulted from a targeted phishing attack that allowed unauthorized access to certain emails and records, potentially affecting personal information including names, member ID numbers, health plan names, and premium payment amounts. The number of affected individuals is currently unknown.

Epic Management LLC suffered a data breach caused by external system hacking between March 2, 2021, and October 9, 2021, compromising the personal information of 10,050 individuals, including two residents of South Carolina. The breach exposed sensitive data, though the exact nature of the leaked information (e.g., financial, medical, or personally identifiable details) was not explicitly disclosed in the report. Affected individuals were notified via written correspondence on December 14, 2022, over a year after the breach’s discovery, and were offered 12 months of identity theft protection services as a remedial measure. The incident highlights vulnerabilities in Epic Management LLC’s cybersecurity defenses, allowing unauthorized actors to infiltrate and exfiltrate data over an extended period. While the company took steps to mitigate risks post-breach, the delay in detection and notification raises concerns about proactive monitoring and response protocols. The breach’s scale and the provision of identity protection suggest the compromised data could enable fraud or identity theft, though no immediate financial or operational disruptions to the company were reported. The attack underscores the persistent threat posed by external hackers targeting organizations with weak perimeter security or delayed incident response mechanisms.