Endeavor Energy Resources

Endeavor Energy Resources, also known as Endeavor Energy, is headquartered in the United States of America. The organization operates as an employer that provides a health plan to its workforce, affiliates, and the dependents of those individuals. This health plan encompasses current and former employees as well as associated affiliates. The company’s role as a sponsor of a group health plan brings it under certain federal privacy regulations. These organizational characteristics are relevant to understanding the context of the security incident that occurred in early 2020.

On January 14, 2020, Endeavor Energy Resources experienced a phishing attack that resulted in the compromise of an employee’s Office 365 account. The compromised account was used to access protected health information stored within the company’s health plan system. The exposed data included names and health plan member IDs of current and former employees, affiliates, and dependents enrolled in the plan. A total of 5,103 individuals were potentially affected by the breach. Because the information involved health plan identifiers, the incident triggered notification obligations under the Health Insurance Portability and Accountability Act (HIPAA). The organization issued breach notifications to the impacted individuals in accordance with those requirements.

At the time of public disclosure, no misuse of the compromised data had been reported. In response to the incident, Endeavor Energy Resources implemented enhanced safeguards to strengthen the security of its Office 365 environment and related systems. The organization also conducted additional security evaluations to identify and address any remaining vulnerabilities. To assist affected persons, a dedicated call center was established to answer questions and provide support regarding the breach. These measures were intended to reduce the likelihood of similar incidents occurring in the future.