Late last week, the Alaska Department of Health and Social Service (DHSS) disclosed the intrusion technique and impact of a “highly sophisticated” cyberattack that occurred in early May 2021 by a currently unnamed nation-state threat group. It is believed that the threat group gained access to the DHSS internal network via a vulnerability in one of the department’s websites. The DHSS emphasized in their Frequently Asked Questions document, linked below, that there is no evidence that the threat group is still active in their environment. The Alaska DHSS did provide an updated press release, linked below, that details the current state of their investigation and that a security breach of Health Insurance Portability and Accountability Act (HIPAA) and the Alaska Personal Information Protection Act (APIPA) related data did occur. The press release explained that the number of impacted individuals is currently unknown but revealed that any data stored on the department’s information technology infrastructure is possibly involved. The threat group potentially had access to the following information: full names, dates of birth, addresses, telephone numbers, driver’s license numbers, Social Security numbers, internal identifying numbers (such as case reports, protected service reports, and Medicaid), Health and Financial information, and historical information regarding past interaction with the DHSS. Notification letters will be sent to impacted individuals during the last week of September 2021 and the systems breached during the cyberattack remain offline as systems are being restored.