City of Philadelphia

Summary

The City of Philadelphia experienced a cyberattack involving unauthorized access to its email systems over a multi-month period, potentially compromising sensitive information of city employees. The breach exposed personal and health-related data, including names, addresses, Social Security numbers, dates of birth, medical diagnoses, treatment details, and limited financial claims information. Following the discovery of suspicious email activity, the municipality initiated an investigation with third-party cybersecurity specialists, implemented additional safeguards to secure its systems, and began notifying affected individuals. The incident was reported to federal health authorities, and ongoing reviews aim to identify all impacted parties while reinforcing email security protocols and staff training.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On May 24, 2023, the City of Philadelphia detected suspicious activity within its email environment, prompting an immediate investigation with assistance from third-party cybersecurity specialists. The investigation determined that between May 26 and July 28, 2023, an unauthorized actor potentially gained access to certain city email accounts. While the full scope remained under review, the compromised accounts contained sensitive information belonging to city employees. On August 22, 2023, officials confirmed these email accounts included protected health information (PHI), expanding the severity of the breach. The types of exposed data varied by individual but encompassed demographic details such as names, addresses, dates of birth, and Social Security numbers, alongside medical information including diagnoses, treatment details, and limited financial claims data. The breach period lasted 63 days, during which attackers maintained persistent access to email systems.

The city initiated containment measures by securing its email environment and systems upon discovery. It reported the incident to the U.S. Department of Health and Human Services and committed to notifying other regulators as necessary. A comprehensive manual and programmatic review of affected email accounts began to identify impacted individuals, with plans to issue written notifications once identities and contact details were verified. Concurrently, Philadelphia launched an internal review of information security policies, implemented additional administrative and technical safeguards, and expanded employee training on email security protocols. The investigation remained ongoing as of October 20, 2023, with no public attribution to specific threat actors or disclosure of initial attack vectors. The incident exposed vulnerabilities in the city’s email-based data handling, particularly concerning PHI storage and transmission practices.

Sources

Sources available to members: 2 sources.