Imagine360 Suffers Breaches of Two File-Sharing Platforms
Imagine360, a Wayne, PA-based provider of a self-funded health plan solution for employers, was the victim of two cyberattacks this year involving its file-sharing solutions. The first attack was detected on or around January 30, when suspicious activity was detected within its Citrix file-sharing solution, which Imagine 360 uses to securely exchange files related to self-insured health plans. Steps were immediately taken to secure the platform by taking it offline, passwords were reset, and an investigation was launched into the attack.
A few days later, while Imagine360 was investigating the Citrix breach, a vulnerability was exploited in another file-sharing platform – Fortra’s GoAnywhere Transfer solution. Fortra determined that an unauthorized actor – now known to be the Clop ransomware group – exploited a zero-day vulnerability and stole sensitive data.
Imagine360 independently investigated both security incidents and confirmed that its own systems were unaffected and remained secure at all times; however, files were stolen in both attacks between January 28 and January 30, 2023. The stolen files included names, medical information, health insurance information, and Social Security numbers, with the impacted data varying from individual to individual.
The review of the affected files took until June 1, 2023, after which contact information was verified to allow notification letters to be sent. Imagine360 said the decision was taken to suspend the use of the Fortra file transfer solution, and additional safeguards have been added to its policies, processes, and security measures to prevent similar breaches in the future.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The notification letter to the California Attorney General and the version uploaded to the Imagine360 website make no mention of credit monitoring and identity theft protection services being offered to the affected individuals. The HHS’ Office for Civil Rights breach portal lists an incident that affected 112,611 individuals. It is unclear if this relates to one or both incidents.
