Recently, Covenant Care California, LLC announced that the company experienced a data breach that compromised sensitive consumer information stored on its network. Evidently, an employee at one of the company’s facilities responded to a phishing attack, providing the unauthorized party with access to her email account—and all the data contained therein. On May 6, 2022, Covenant Care filed official notice of the breach and sent out data breach letters to all affected parties.

If you received a data breach notification, it is essential you understand what is at risk and what you can do about it. To learn more about how to protect yourself from becoming a victim of fraud or identity theft and what your legal options are in the wake of the Covenant Care California data breach, please see our recent piece on the topic here.

What We Know About the Covenant Care California Data Breach

According to an official notice filed by the company, on February 24, 2022, Covenant Care discovered that an employee at the company’s Wagner Heights Nursing and Rehabilitation Center began experiencing issues with her email account. Upon further investigation, the company verified that the employee had responded to a phishing attack, which gave an unauthorized user access to the employee’s email account.

In response, Covenant Care then sought to determine if any consumer data was leaked as a result of the incident. On April 18, 2022, the company confirmed that certain patient records were present in the account at the time of the unauthorized access.

Upon discovering that sensitive consumer data was accessible to an unauthorized party, Covenant Care California then reviewed the affected files to determine exactly what information was compromised. On May 6, 2022, Covenant Care California sent out data breach letters to all individuals whose information was compromised as a result of the recent data security incident.

Covenant Care California, LLC is a provider of short- and long-term residential treatment based in Aliso Viejo, California. The company operates 30 skilled nursing facilities, assisted living facilities, rehabilitation centers, and residential care centers across California. Currently, Covenant Care provides care for more than 4,000 residents and patients. Covenant Care California employs more than 8,000 people and generates approximately $1 billion in annual revenue.

What Is Phishing?

Phishing describes a type of cyberattack in which a malicious actor sends a seemingly legitimate email to a person in hopes of getting the recipient to unknowingly either provide them with information or access to their device or network. To do this, a hacker typically relies on social engineering principles to “trick” the recipient into trusting—or at least not questioning—the source of the email.

Phishing attacks are incredibly common. In fact, according to the Identity Theft Resource Center, in 2021, a third of all cyberattacks involved phishing. However, companies can take steps to reduce the risk of a phishing attack. For example, by providing consistent training to employees, most phishing attacks could be avoided. Unlike other types of cyberattacks, phishing relies on an employee’s participation; unless an employee clicks on a link or responds to the email, the attack will fail. However, employees cannot be expected to know a legitimate email from a fraudulent one without the proper training. Thus, a robust employee training program on the importance of email security is the first line of defense against phishing attacks.