HIPAA Journal is the leading provider of news, updates, and independent advice for HIPAA compliance

SEIU 775 Benefits Group Data Breach Impacts 140,000 Individuals

A benefits administrator for home healthcare and nursing home workers, Service Employees International Union 775 (SEIU 775) Benefits Group, has experienced a cyberattack that resulted in the deletion of sensitive data.

IT staff detected anomalies within SEIU 775’s data systems on or around April 4, 2021, which included the deletion of certain data. An investigation was launched into the malicious activity, led by third-party cybersecurity experts and forensic consultants.

The investigation confirmed that its systems had been hacked and the data of unknown individuals had been deleted, including personally identifiable and protected health information. While information was deleted, no evidence was found to indicate any PII or PHI was viewed or acquired by the attackers and there have been no reported cases of misuse of data.

Data potentially compromised included names, addresses, and demographic data along with Social Security numbers and potentially health plan eligibility information. Upon discovery of the malicious activity, steps were immediately taken to prevent further unauthorized access and to contain the breach. Third -party cybersecurity experts have been assessing system security and SEIU 775 is working closely with its consultants to further strengthen its cybersecurity defenses.

Please see the HIPAA Journal Privacy Policy

3 Steps To HIPAA Compliance

Please see HIPAA Journal
privacy policy

  • Step 1 : Download Checklist.
  • Step 2 : Review Your Business.
  • Step 3 : Get Compliant!

The HIPAA Journal compliance checklist provides the top priorities for your organization to become fully HIPAA compliant.

The breach has been reported to the HHS’ Office for Civil Rights as affecting up to 140,000 individuals. Victims of the breach have been offered complimentary credit monitoring and identity theft protection/restoration services through Kroll for 12 months.

This is not the only breach to be reported in recent weeks by a benefits administrator. In May, the Florida vision and hearing benefits administrator 20/20 Hearing Care Network experienced a data deletion incident. In that incident, the breach affected up to 3.3 million individuals. The attacker gained access to and deleting data stored in an unprotected Amazon Web Services cloud storage bucket, with the data downloaded from the S3 bucket prior to deletion.

Author: Steve Alder is the editor-in-chief of HIPAA Journal. Steve is responsible for editorial policy regarding the topics covered on HIPAA Journal. He is a specialist on healthcare industry legal and regulatory affairs, and has several years of experience writing about HIPAA and other related legal topics. Steve has developed a deep understanding of regulatory issues surrounding the use of information technology in the healthcare industry and has written hundreds of articles on HIPAA-related topics.