Data breach at Harris Center exposes personal information of over 445,000 individuals

The Harris Center for Mental Health and IDD said a data security incident it suffered in November 2023 compromised the sensitive personal information of more than 445,000 patients.

 

Based in Houston, Texas, the Harris Center for Mental Health and IDD provides behavioural and developmental disability care to patients throughout Harris County, with services offered at more than 80 locations.

 

In a data security incident notice published on its website, the Harris Center said that on November 7, 2023, it experienced a network disruption. The healthcare provider immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

It also took steps to contain the incident, reviewed its policies and procedures and notified relevant law enforcement authorities about the same.

 

“Our investigation determined that certain information stored on our network was accessed by an unauthorised individual between November 6, 2023, and November 7, 2023,” the Harris Center said.

 

The compromised data included names, addresses, phone numbers, email addresses, dates of birth, Social Security Numbers, U.S. Alien Registration Numbers, driver’s license/state ID numbers, financial account information, treatment/diagnosis information, prescription information, provider names, medical records/case numbers, Medicare/Medicaid ID numbers, health insurance information, and treatment cost.

 

In a filing with the Office of Texas Attorney General, the Harris Center said it has identified at least 446,749 individuals impacted by the incident.

 

The Harris Center has advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.

 

It has also offered complimentary identity protection and credit monitoring services to all affected individuals.

 

At the time of publishing, no known hacker group claimed responsibility for the cyber attack on the Harris Center. The healthcare provider also did not share details on who was behind the attack, how much data was compromised, or whether it has received a ransom demand.