SEIU 775 Benefits Group Data Breach Impacts 140,000 Individuals
A benefits administrator for home healthcare and nursing home workers, Service Employees International Union 775 (SEIU 775) Benefits Group, has experienced a cyberattack that resulted in the deletion of sensitive data.
IT staff detected anomalies within SEIU 775’s data systems on or around April 4, 2021, which included the deletion of certain data. An investigation was launched into the malicious activity, led by third-party cybersecurity experts and forensic consultants.
The investigation confirmed that its systems had been hacked and the data of unknown individuals had been deleted, including personally identifiable and protected health information. While information was deleted, no evidence was found to indicate any PII or PHI was viewed or acquired by the attackers and there have been no reported cases of misuse of data.
Data potentially compromised included names, addresses, and demographic data along with Social Security numbers and potentially health plan eligibility information. Upon discovery of the malicious activity, steps were immediately taken to prevent further unauthorized access and to contain the breach. Third -party cybersecurity experts have been assessing system security and SEIU 775 is working closely with its consultants to further strengthen its cybersecurity defenses.
Get The FREE
HIPAA Compliance Checklist
Immediate Delivery of Checklist Link To Your Email Address
Please Enter Correct Email Address
Your Privacy Respected
HIPAA Journal Privacy Policy
The breach has been reported to the HHS’ Office for Civil Rights as affecting up to 140,000 individuals. Victims of the breach have been offered complimentary credit monitoring and identity theft protection/restoration services through Kroll for 12 months.
This is not the only breach to be reported in recent weeks by a benefits administrator. In May, the Florida vision and hearing benefits administrator 20/20 Hearing Care Network experienced a data deletion incident. In that incident, the breach affected up to 3.3 million individuals. The attacker gained access to and deleting data stored in an unprotected Amazon Web Services cloud storage bucket, with the data downloaded from the S3 bucket prior to deletion.
