2023-04-13 ENZO BIOCHEM INC Cybersecurity Incident

Page last updated on September 16, 2024

ENZO BIOCHEM INC initially disclosed a cybersecurity incident in an SEC 8-K filing on 2023-04-13 17:24:34 EDT.

Incident Details

Material: Unknown
Is Breach: Unknown
Records Compromised: Unknown
Data Types Impacted: No Data Types Tracked (yet)

Compromised Date: 2023-04-06
Detected Date:
Disclosure Date: 2023-04-13
Contained Date:
Recovered Date:

Attack Goal: Unknown

Costs: $4.5M

• Regulatory fines (Direct): $4.5M - The Company agreed to monetary relief in the amount of $4.5 million dollars in agreements with the Attorneys General of New York, New Jersey and Connecticut.

Filings

8-K filed on 2023-04-13

ENZO BIOCHEM INC filed an 8-K at 2023-04-13 17:24:34 EDT
Accession Number: 0001213900-23-029594

Item 8.01 Other Events.

On April 6, 2023, Enzo Biochem, Inc. (the “Company”) experienced a ransomware attack that impacted certain information technology systems. In response, the Company promptly deployed containment measures, including disconnecting its systems from the internet, and launched an investigation with assistance from third-party cybersecurity experts. The Company has activated its disaster recovery plan, which allows it to continue operations while it brings its systems back online.

On April 11, 2023, the Company became aware that certain data was extracted from the Company’s information technology systems as part of this incident. The investigation of this incident and the assessment of its impact is ongoing.

The Company’s facilities remain open, and it continues to provide services to its patients and partners using established back-up processes and other downtime procedures. However, these back-up procedures can create operational challenges and have caused delays in the processing of laboratory specimens. The Company is actively engaged in fully restoring or replacing affected systems, which is expected to be largely complete in the coming days.

The Company is also evaluating the extent of the incident and working diligently to mitigate its effects. The Company has incurred, and may continue to incur, certain expenses related to this attack, including expenses to respond to, remediate and investigate this matter. Further, the Company remains subject to risks and uncertainties as a result of the incident, including as a result of the data that was extracted from the Company’s network as noted above.

8-K filed on 2023-05-30

ENZO BIOCHEM INC filed an 8-K at 2023-05-30 16:15:20 EDT
Accession Number: 0001213900-23-044007

Item 8.01 Other Events.

As previously disclosed, on April 6, 2023, Enzo Biochem, Inc. (the “Company”) experienced a ransomware attack that impacted certain information technology systems. In response, the Company promptly deployed containment measures, including disconnecting its systems from the internet, launched an investigation with assistance from third-party cybersecurity experts, and notified law enforcement. The Company adhered to its disaster recovery plan, which enabled it to maintain operations throughout the incident response process. The Company’s facilities are open, and it continues to provide services to its patients and partners.

On April 11, 2023, the Company became aware that certain data, including names, test information, and Social Security numbers, was accessed, and in some instances, exfiltrated from the Company’s information technology systems as part of this incident. The investigation of this incident and the assessment of its impact is ongoing. However, the Company identified unauthorized access to or acquisition of clinical test information of approximately 2,470,000 individuals. The Social Security numbers of approximately 600,000 of these individuals may also have been involved. The Company is evaluating whether its employees’ information may have been involved. The Company will provide notice to the individuals whose information may have been involved, as well as to regulatory authorities, in accordance with applicable law.

The Company has incurred, and may continue to incur, certain expenses related to this attack, including expenses to respond to, remediate and investigate this matter. Further, the Company remains subject to risks and uncertainties as a result of the incident, including as a result of the data that was accessed or exfiltrated from the Company’s network as noted above. Additionally, security and privacy incidents have led to, and may continue to lead to, additional regulatory scrutiny. The Company is in the process of evaluating the full scope of the costs and related impacts of this incident.

For further information regarding the risks associated with cyber security incidents and disruptions to our operations, please see “Risk Factors” in the Company’s Annual Report on Form 10-K for the fiscal year ended July 31, 2022.

8-K filed on 2024-08-14

ENZO BIOCHEM INC filed an 8-K at 2024-08-14 16:15:16 EDT
Accession Number: 0001213900-24-069031

Item 8.01 Other Events.

Agreement Reached with Attorneys General of New York, New Jersey and Connecticut

On August 13, 2024, the Attorneys General of New York and Connecticut issued press releases announcing that agreements, effective as of August 8, 2024, were entered into between Enzo Biochem, Inc., its subsidiary Enzo Clinical Labs, Inc., the assets of which were sold resulting in the cessation of our clinical services operations (together the “Company”), and the Attorneys General of New York, New Jersey and Connecticut. These agreements, consisting of an Assurance of Discontinuance entered into with the New York Attorney General, a Consent Order, entered into with the New Jersey Attorney General, and an Assurance of Voluntary Compliance, entered into with the Connecticut Attorney General, resolve inquiries previously disclosed in the Company’s public filings related to the ransomware attack it experienced in April 2023. As stated in the terms of these agreements, the Company cooperated with the investigations and neither admits nor denies the investigative findings of the Attorneys General. The Company also agrees to monetary relief in the amount of $4.5 million dollars, which shall, within 45 days, be divided and the apportionment paid directly to each of the Attorneys General at their direction. The agreements further require the Company to implement and maintain certain cybersecurity enhancements, substantially all of which have already been undertaken or are underway, as well as an Information Security Program as described in the agreements, on a going forward basis.

Company Information