PurFoods, LLC, operating under the trade name Mom’s Meals, has announced the compromise of personal information affecting its clients and employees.
The company acknowledged that its cybersecurity defenses had been compromised, allowing unauthorized access to a treasure trove of consumer data.
The incident occurred between January 16, 2023, and February 22, 2023, with the attack involving the encryption of specific files on the company’s network.
A third-party investigation revealed tools that could facilitate unauthorized data transfer, indicating potential data exfiltration.
The data breach has exposed a trove of sensitive information, including but not limited to:
- Date of birth
- Driver’s license/state identification number
- Financial account information
- Payment card information
- Medical record number
- Medicare and/or Medicaid identification
- Health information
- Treatment information
- Diagnosis code
- Meal category and/or cost
- Health insurance information
- Patient ID number
Less than 1% of the affected population had their Social Security numbers compromised. Total number of persons affected (including residents): 1,237,681
It’s important to emphasize that no evidence suggests misuse or further disclosure of the compromised data in the aftermath of the breach.
“It’s important to note that we have seen no evidence that any personal information was misused or further disclosed as a result of the cyberattack.”
Response and Mitigation
Mom’s Meals has undertaken a series of measures in response to the breach:
- Notification to federal law enforcement agencies and collaboration with their investigation
- Notification to affected individuals via U.S. Mail commenced on August 25, 2023
- Offer of identity theft and fraud protection services, including credit monitoring and identity restoration
- Engagement of Kroll to manage a call center for inquiries related to the breach
In light of the breach, PurFoods has prioritized reinforcing its network security and an internal review of existing policies and procedures to enhance data protection measures.
