Magellan Health Data Breach Victim Tally Reaches 365K Patients

2 Health Insurance Companies Report Hack of Member Portals

Independence Blue Cross and AmeriHealth New Jersey both reported suspected hacks of their member portals, caused by credential reuse. 

The notifications from the insurance companies are nearly identical. On May 8, officials said they discovered that certain member information may have been accessible for unauthorized viewing through the relevant member portals. 

An investigation was launched to determine the scope of the incident, which found some plan members used the same password credentials across multiple websites. The impacted credentials were stolen during the 2018 compromise of the MyFitnessPal application. 

As a result, hackers were able to use the stolen credentials to gain access to certain pages within the member portals. For both insurance companies, the access continued from March 17 through April 30, 2020. 

The data compromised during the hacks included information related to the affected members, such as names, member identification numbers, plan types, spending account balances, user reward summaries, and claims data. No Social Security numbers, financial data, or credit cards were impacted.

All patients will receive two years of free credit monitoring. Both insurers have since taken steps to ensure the security of member portals, while reviewing company policies and procedures and implementing additional controls to prevent future incidents. 

Password reuse is a common security mistake, with the Department of Homeland Security recently warning that hackers are compromising Virtual Private Networks (VPNs) with stolen credentials. The attacks are highly successful, given the frequency of users failing to update passwords after a known breach or reusing passwords across different platforms. 

Ransomware Attack on Healthcare Fiscal Management Impacts 58K

Nearly two months after Maze ransomware hackers claimed to have posted data stolen from Healthcare Fiscal Management on the dark web, the revenue cycle management company has confirmed an April breach to HHS. 

In total, 58,000 patients are being notified that their data was breached during the incident. 

The hacking group posted a zip file with data allegedly stolen from HFM during a ransomware attack in April. The recent breach notification explained the cyberattack impacted St. Mary’s Health Care System patients who visited the Athens, Georgia provider between November 2019 through April 2020.

The notice did not confirm the breach was tied to Maze. 

The ransomware attack was first discovered by HFM on April 13, which impacted portions of its server and data infrastructure. The systems were taken offline, and HFM moved to restore the servers using a new hosting vendor with heightened security tools and monitoring. 

An investigation was launched with assistance from an outside forensics firm, which found the hackers first accessed the server on April 12 before the ransomware was launched the next day. As a result, the attackers were able to access or acquire patient data, including Social Security numbers, dates of birth, protected health information, medical record numbers, and a host of other personal information. 

HFM was able to restore security and services on the same day the attack was discovered using backs and other information maintained by the vendor. The forensics team was able to determine the data “is no longer in possession of third-parties or accessible via the internet.” 

The vendor is continuing to strengthen its security program and has offered impacted patients a year of credit monitoring and identity theft protection services.