Barrow County in georgia issued a breach note about a transgress of its email environment that occurred between mar and August of 2022. Its notification, posted on its website, states, in part: The type of info at egress varied for each individual, but included a variation of the following: name; engagement of birth, social Security number; drivers license or state identification number, financial account information, credit or debit card information, including the expiration and CVV code, clinical and treatment information, medical provider information, prescription information, indemnity policy information, and/or patient account or medical record numbers. They first notified people this week. The observation does not say when they first discovered the breach, but only that “Upon learning of the incident, Barrow County promptly began an internal investigation and engaged a forensic security firm to inquire the incident and secure its computer and email systems.” So: 1. When and how did they first discover the breach and start to investigate? 2. How many people are they notifying? 3. How far indorse in time did the emails that were vulnerable or accessed go? 4. why did it submit them from the time they first discovered a breach to figure out everyone who needed to be notified? 5. Was the health data in the emails from the county as a health program or as a provider or as a business colligate to Northeast Georgia Medical Center? Has HHS been notified of this breach? DataBreaches would ask them these questions but they don’t seem to stake any email contact information on their website.