‘Data security event’ in city’s email system may have exposed health information, Philly officials say

A potential data breach in the City of Philadelphia’s email system earlier this year may have exposed protected health information for an unspecified number of people.

The city became aware on May 24 of suspicious activity in its email system, officials said in a statement Friday. Between May 25 and July 29, an unauthorized user may have gained access to city email accounts that possibly contained protected health information, cybersecurity specialists determined in an investigation that remains ongoing.

Information that may have been exposed could include names, addresses, birth dates, Social Security numbers, medical information, and some financial information.

A city representative did not immediately respond to a request for further comment. It remains unclear how the breach occurred, why officials waited months to make a public statement, or whether the breach disrupted city services.

City officials said they were performing a manual review of email accounts that may have been impacted in order to determine if personal or other health information was breached. Affected individuals will receive notice via written letter, the city said Friday.

Officials also launched a toll-free line for those potentially impacted, which can be reached at 1-888-867-2241. The city also said it would review existing information, security policies and procedures, and implement additional safeguards in the wake of the potential breach.

The city last reported a significant email breach in 2020, which came following a successful phishing attack on an employee email account. That breach impacted individuals being serviced by the Department of Behavioral Health and Intellectual Disability Services, as well as a nonprofit known as Community Behavioral Health.