Email Accounts Compromised at Welcome Health & United Way of Connecticut
Welcome Health and United Way of Connecticut have reported breaches of employee email accounts and potential unauthorized access to patient data.
Welcome Health
On July 8, 2024, Welcome Health identified suspicious activity in a user’s email account and immediately terminated access to its systems. The forensic investigation confirmed that the user’s credentials had been compromised and were used by an unauthorized individual to access Welcome Health’s systems between June 11, 2024, and July 8, 2024.
The file review was completed on August 12, 2024, and confirmed that patient and contractor information had potentially been viewed or acquired. For patients, the compromised information included first and last name, date of birth, patient number, health plan member number, claim number, date(s) of service, and diagnosis and treatment information. Contractors affected by the incident had their first and last names, Social Security numbers, and tax identification numbers compromised.
The affected individuals have now been notified and offered complimentary credit monitoring and identity theft protection services. In response to the security breach, Welcome Health has reinforced its security policies and provided targeted security awareness training to its workforce. The breach is not yet shown on the HHS’ Office for Civil Rights breach portal, so it is currently unclear how many individuals have been affected.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
United Way of Connecticut
United Way of Connecticut, Inc. has recently reported an email account breach to the HHS’ Office for Civil Rights that involved the protected health information of up to 8,039 patients. The incident involved a single employee email account that was compromised on May 29, 2024, as a result of a response to a phishing email.
The attacker obtained credentials that allowed the email account to be accessed. No other systems were compromised. The email account is being reviewed and all affected individuals will be notified and offered complimentary credit monitoring services. It is possible that the breach involved a smaller number of individuals. The decision was taken to report the breach to regulators using the maximum number of individuals potentially affected.
