Medical meal service says over 1 million customers exposed in hack

Don’t let the hackers eat your lunch.

At least that’s what a Friday notice said when meal delivery service PurFoods disclosed that a data breach earlier this year may have exposed the financial details and Social Security number of more than 1.2 million people.

PurFoods, which does business as specialty food-prep company Mom’s Meals, told the Maine attorney general’s office that an external breach exposed customers’ credit and debit card numbers, as well as other details like passwords.

Since the company provides nutritional services under Medicare, Medicaid, and other health plans, it said the batch of stolen data could also include Social Security and drivers’ license numbers and dates of birth, in addition to medical and health details.

PurFoods first became aware of suspicious activity in February, the company said in a regulatory statement. It later determined that a January cyberattack involved the encryption of some internal files.

“Because the investigation also identified the presence of tools that could be used for data exfiltration, PurFoods was not able to rule out the possibility that data was taken from one of its file servers,” according to the statement..

Financial services firm Kroll will provide free credit monitoring for affected Mom’s Meals customers over the next year, PurFoods said, and it’s “working to implement additional safeguards and training to its employees.”

In March, Mom’s Meals came under fire in Pennsylvania and Iowa for mysterious “system challenges” that caused meal delivery delays and put some employees temporarily out of work. For now, the company says it has notified customers about the breach and is educating them about how to shore up their accounts.

As IT Brew previously reported, data breaches are costing affected organizations more than ever—averaging $4.4 million per incident over the past year. While hospitals shore up their cybersecurity defenses, medical-adjacent third parties (like this scrubs retailer) remain attractive targets for hackers to extract juicy personal details.