Three fourths of U.S. citizens have had their personal health information exposed by cybersecurity attacks since 2020.
The health care sector is frequently targeted by hackers, with HealthEquity being one of the latest victims. The massive data breach affected 4.3 million people. HealthEquity detected the possible breach in late March and by June 10 confirmed unauthorized access to protected health (PHI) and personally identifiable information (PII). The company has assured that it is taking steps to notify affected individuals, including both business clients and individual account holders. Notifications are being sent out via mail or email.
Impact of the Breach
The exposed data includes first and last names, addresses, telephone numbers, employee IDs, employers, Social Security numbers, health card numbers, health plan member numbers, dependent contact information, and more. While not all categories of data were affected for every individual, the breach underscores the potential risks posed by compromised personal information.
Although HealthEquity has no evidence of misuse of the information, the company has taken several proactive measures to mitigate the damage including securing the affected data repository, disabling compromised vendor accounts, terminating active sessions, and blocking IP addresses linked to the threat actors.
HealthEquity’s Response
In response to the breach, HealthEquity has implemented a global password reset for the impacted vendor and arranged for credit identity monitoring, insurance, and restoration services through Equifax. These services will be available free of charge for two years to those affected.
HealthEquity also emphasized its commitment to transparent communication, filing a notification with the Securities and Exchange Commission (SEC), even though it was not required. The company has assembled a team of internal and external experts to investigate and respond to the incident.
Protect Your Personal Data and Privacy.
- Invest in identity theft protection: If you have been affected by a data breach, scammers may try to impersonate you to gain access to your private information. The best thing you can do to protect yourself is to subscribe to an identity theft service. Identity theft companies can monitor personal information like your Social Security number (SSN), phone number and email address and alert you if it is on the dark web or being used to open an account. They can also help freeze your bank and credit card accounts.
- Invest in removal services: Following data breaches like HealthEquity’s, removal services like MyPrivacy360 can help monitor and automate the removal of your information from numerous sites over time.
- Place a fraud alert: Contact one of the three major credit reporting agencies (Equifax, Experian or TransUnion) and request a fraud alert to be placed on your credit file. This makes it more difficult for identity thieves to open new accounts in your name without verification.
- Be cautious of phishing attempts: Stay cautious of emails, calls, or messages requesting personal information. Avoid clicking on suspicious links and ensure antivirus protection is installed on all devices to prevent malware and phishing scams.
- Check Social Security benefits: Regularly review your Social Security benefits to ensure they have not been altered in any way.
- Change your password: Protect yourself by changing stolen passwords, using strong, unique passwords, or using a password manager.
- Be wary of mailbox communications: Scammers may contact you through snail mail which gives them access to your address. They may impersonate people or brands you know and use themes that require urgent attention, like missed deliveries or fake security alerts.
- Contact the U.S. Federal Trade Commission: If you detect unauthorized transactions or identity theft, notify your financial institution and report it to local authorities, the state attorney general, and the FTC.
The HealthEquity data breach highlights the need for strong cybersecurity practices, especially when it comes to protecting personal and health information. Our MyPrivacy360 product helps remove your personal information from the web.
