2023-04-13 ENZO BIOCHEM INC Cybersecurity Incident

Page last updated on April 11, 2024

ENZO BIOCHEM INC initially disclosed a cybersecurity incident in an SEC 8-K filing on 2023-04-13 17:24:34 EDT.

Incident Details

Material: Unknown
Is Breach: Unknown
Records Compromised: Unknown
Data Types Impacted: No Data Types Tracked (yet)

Compromised Date: 2023-04-06
Detected Date:
Disclosure Date: 2023-04-13
Contained Date:
Recovered Date:

Attack Goal: Unknown

Costs: No Costs Tracked (yet)

Filings

8-K filed on 2023-04-13

ENZO BIOCHEM INC filed an 8-K at 2023-04-13 17:24:34 EDT
Accession Number: 0001213900-23-029594

Item 8.01 Other Events.

On April 6, 2023, Enzo Biochem, Inc. (the “Company”) experienced a ransomware attack that impacted certain information technology systems. In response, the Company promptly deployed containment measures, including disconnecting its systems from the internet, and launched an investigation with assistance from third-party cybersecurity experts. The Company has activated its disaster recovery plan, which allows it to continue operations while it brings its systems back online.

On April 11, 2023, the Company became aware that certain data was extracted from the Company’s information technology systems as part of this incident. The investigation of this incident and the assessment of its impact is ongoing.

The Company’s facilities remain open, and it continues to provide services to its patients and partners using established back-up processes and other downtime procedures. However, these back-up procedures can create operational challenges and have caused delays in the processing of laboratory specimens. The Company is actively engaged in fully restoring or replacing affected systems, which is expected to be largely complete in the coming days.

The Company is also evaluating the extent of the incident and working diligently to mitigate its effects. The Company has incurred, and may continue to incur, certain expenses related to this attack, including expenses to respond to, remediate and investigate this matter. Further, the Company remains subject to risks and uncertainties as a result of the incident, including as a result of the data that was extracted from the Company’s network as noted above.

8-K filed on 2023-05-30

ENZO BIOCHEM INC filed an 8-K at 2023-05-30 16:15:20 EDT
Accession Number: 0001213900-23-044007

Item 8.01 Other Events.

As previously disclosed, on April 6, 2023, Enzo Biochem, Inc. (the “Company”) experienced a ransomware attack that impacted certain information technology systems. In response, the Company promptly deployed containment measures, including disconnecting its systems from the internet, launched an investigation with assistance from third-party cybersecurity experts, and notified law enforcement. The Company adhered to its disaster recovery plan, which enabled it to maintain operations throughout the incident response process. The Company’s facilities are open, and it continues to provide services to its patients and partners.

On April 11, 2023, the Company became aware that certain data, including names, test information, and Social Security numbers, was accessed, and in some instances, exfiltrated from the Company’s information technology systems as part of this incident. The investigation of this incident and the assessment of its impact is ongoing. However, the Company identified unauthorized access to or acquisition of clinical test information of approximately 2,470,000 individuals. The Social Security numbers of approximately 600,000 of these individuals may also have been involved. The Company is evaluating whether its employees’ information may have been involved. The Company will provide notice to the individuals whose information may have been involved, as well as to regulatory authorities, in accordance with applicable law.

The Company has incurred, and may continue to incur, certain expenses related to this attack, including expenses to respond to, remediate and investigate this matter. Further, the Company remains subject to risks and uncertainties as a result of the incident, including as a result of the data that was accessed or exfiltrated from the Company’s network as noted above. Additionally, security and privacy incidents have led to, and may continue to lead to, additional regulatory scrutiny. The Company is in the process of evaluating the full scope of the costs and related impacts of this incident.

For further information regarding the risks associated with cyber security incidents and disruptions to our operations, please see “Risk Factors” in the Company’s Annual Report on Form 10-K for the fiscal year ended July 31, 2022.

Company Information