PurFoods, the company behind Mom’s Meals, suffered a data breach that may have affected more than 1.2 million people.
The company participated in a 5-month-long investigation that found that unauthorized tools were used for malicious data transfers and that a month-long cyberattack campaign struck their company earlier in January.
The potentially exfiltrated information affects customers who purchased one or more meal deliveries, current and former employees, and even independent contractors.
“We can’t rule out the possibility that data was taken from one of our file servers,” said the PurFoods data breach notice.
The notice also explains how sensitive the stolen data may be. The information in the affected files includes:
- Date of birth.
- Driver’s license/state identification number.
- Financial account information.
- Payment card information.
- Medical record number.
- Medicare and/or Medicaid identification and other health information/treatment. information including diagnosis code and patient ID number.
- Meal category and/or cost.
- Social Security Numbers were stolen in less than 1% of circumstances.
This information can be used by hackers in a number of ways, many hackers sell information on the dark web to the highest bidder, while others use stolen data to perform their own social engineering scams (oftentimes, it’s both.)
The company first noticed the attack in February, which prompted them to respond and begin their investigation by contacting the police and filing a data breach notice with the Office of the Main Attorney General.
“We then worked with our partners to identify accurate address information to provide notice to potentially affected individuals, and only recently completed these efforts,” PurFoods said.
They’re also offering free credit monitoring and identity restoration services for victims, as well as a guide on how to protect themselves against identity theft.
“We have taken a number of steps to further strengthen our network security,” PurFood said. “We also are reviewing our existing policies and procedures to identify additional measures and safeguards.”