Enzo Biochem, Inc. has agreed to a $4.5 million settlement after a cyberattack in April 2023 compromised the personal and private health information of 2.4 million patients.
The settlement, announced on Tuesday, resolves regulatory charges against Enzo Biochem for failing to protect sensitive patient data. The breach occurred when attackers gained unauthorized access using employee credentials that had not been updated in over a decade. The exposed data includes Social Security numbers, health histories, and other sensitive information. New York Attorney General Letitia James, along with counterparts in New Jersey and Connecticut, led the investigations that uncovered serious lapses in Enzo’s data security practices.
The incident is part of ongoing efforts by Attorney General James to hold companies accountable for cybersecurity failures. Earlier this year, James issued a comprehensive data security guide and a business guide on preventing credential stuffing attacks, stressing the need for cybersecurity measures across industries.
“Getting blood work or medical testing should not result in patients having their personal and health information stolen by cybercriminals,” stated New York Attorney General Letitia James. She stressed that healthcare companies must prioritize data security to protect patients from fraud and identity theft, adding that her office will continue to hold companies accountable for lapses.
Related: Cyberattacks on the healthcare sector
This settlement holds Enzo Biochem accountable and warns other healthcare companies about the severe consequences of neglecting cybersecurity. As healthcare data breaches become more common, companies must implement stringent security measures to protect patient information and avoid costly penalties.
Related: Unpacking the benefits of cybersecurity in healthcare
Encryption converts data into a code to prevent unauthorized access. In healthcare, encryption ensures that sensitive patient information remains protected during storage and transmission, even if attackers intercept it.
Read more: What happens to your data when it is encrypted?
Organizations can prevent credential sharing by implementing strict access control policies, regularly auditing account usage, and educating employees on the risks of sharing login information.
Regular risk assessments help identify and address vulnerabilities in an organization's cybersecurity defenses, ensuring that new threats are recognized and mitigated promptly to protect sensitive data.