Unidentified people stole the medical data of millions of Americans from one of the largest insurance companies

One of the largest health insurance companies in New England (USA) Point32Health informed its current and former clients that patient data, including medical history and diagnoses, was stolen by hackers during a ransomware attack.

Point32Health Company (oversees Harvard Pilgrim Health Care and Tufts Health Plan) stated , which first discovered the incident on April 17, 2023 and soon after began an investigation with the help of external cybersecurity experts. Then the company turned off the Harvard Pilgrim systems “to contain the threat” and faced technical problems due to the incident.

The investigation found that data was stolen from Harvard Pilgrim Health’s systems between March 28, 2023 and April 17, 2023. Tufts Health Plan was not injured in the incident.

Harvard Pilgrim said the affected files may contain personal data and protected health information about current and former patients and their dependents, as well as current providers. The non-profit organization serves more than 1.1 million clients primarily in Massachusetts, New Hampshire, Maine, and Connecticut.

The stolen information contains:

• periods of treatment;
• medical history;
• provider names and diagnoses;
• social security numbers (SSN) of customers;
• names, addresses, telephone numbers, dates of birth information on the insurance account of patients;
• tax information of service providers.

At this time, Harvard Pilgrim is not aware of any misuse of personal information and protected health information as a result of the incident, but has nonetheless begun notifying potentially affected individuals to provide them with more information and resources.

Point32Health, which was formed in 2021 from the merger of Harvard Pilgrim and Tufts Health Plan, serves more than 2.2 million people in total. The company is the second largest insurance company in Massachusetts.