Work Health Solutions (WHS), an occupational health services company, suffered a data breach that occurred when an unauthorized party accessed an email account between February 16 and March 24, 2022. The breach impacted more than 13,000 individuals including protected health information (PHI), such as health insurance information, medical information, Social Security numbers, driver’s license numbers, and full names.

The California Office of the Attorney General disclosed a data breach affecting Work Health Solutions, occurring between February 16, 2022, and March 24, 2022. The incident involved unauthorized access to an email account, potentially exposing personally identifiable information (PII) and/or protected health information (PHI) of an unspecified number of individuals. The breach was formally reported on November 9, 2022, nearly eight months after the initial compromise. While the exact scale of the breach remains undisclosed, the exposure of sensitive health and personal data poses significant risks, including identity theft, financial fraud, or misuse of medical records. The delayed detection and reporting further amplify concerns regarding the organization’s cybersecurity posture and incident response capabilities. The compromised email account likely served as a vector for exfiltrating confidential data, though the attack’s full scope—such as whether the data was actively stolen or merely accessed—has not been detailed. As a healthcare-adjacent entity, the breach underscores vulnerabilities in handling protected health information, potentially violating regulatory frameworks like HIPAA. The incident highlights the critical need for robust email security, multi-factor authentication, and timely breach notifications to mitigate harm to affected individuals.