Florida officials announced late Friday that hackers may have accessed the personal information and medical records of up to 30,000 Medicaid recipients in November.

The state’s Agency for Health Care Administration said in a Friday evening news release that one of its employees “was the victim of a malicious phishing email” on November 15, and they learned of the incident five days later on 20 November, after which they notified the notified the Inspector General who launched an investigation “to identify if any protected health information was potentially accessed.”

The preliminary findings of an Inspector General investigation found that hackers may have partly or fully accessed the enrollees’ full names, Medicaid ID numbers, birthdates, addresses, diagnoses, medical conditions and Social Security numbers.