716,000 Impacted by OpenLoop Health Data Breach

"An unauthorized third party had gained access to certain OpenLoop systems and removed certain information. The notification letters filed with the Attorney General's Offices in California and Texas say the intrusion was discovered on January 7, and that the hackers had access to its systems between January 7 and January 8. The letters state that personal information was stolen, including names, addresses, email addresses, birth dates, and medical data."

"This incident did not involve access to your electronic health record, Social Security number, or financial account information. OpenLoop Health said it immediately terminated the unauthorized access and launched an investigation into the matter with assistance from external cybersecurity specialists. It also improved its security controls and coordinated with law enforcement. The company said it was not aware of any misuse of the stolen personal information."

"OpenLoop Health urged the affected individuals to remain vigilant for fraud and identity theft. The company also provided them with one year of free identity and credit monitoring services. The telehealth platform has not shared information on the threat actor responsible for the attack, but a threat actor reportedly claimed the attack earlier this year, saying they stole the information of 1.6 million individuals."

An intrusion at telehealth platform OpenLoop Health resulted in theft of personal information from 716,000 individuals. The unauthorized access was discovered on January 7, with access occurring between January 7 and January 8. Stolen data included names, addresses, email addresses, birth dates, and medical data. The notification stated the incident did not involve access to electronic health records, Social Security numbers, or financial account information. OpenLoop Health terminated the unauthorized access, investigated with external cybersecurity specialists, improved security controls, and coordinated with law enforcement. The company reported no awareness of misuse, advised affected individuals to watch for fraud and identity theft, and offered one year of free identity and credit monitoring. The responsible threat actor was not identified by the company.

Read at SecurityWeek