Excellus BlueCross BlueShield hacked; 10.5 million people affected
Hackers had access to information systems for more than a year and a half before the health plan even noticed the cyberattack had occurred.
New York health plan Excellus BlueCross BlueShield on Wednesday said it was a victim of a cyberattack that affected 10.5 million beneficiaries. Even worse, the plan said hackers had access to information systems for more than a year and a half before the health plan even noticed the cyberattack had occurred.
The health plan, which covers members living across 21 counties in New York State, first discovered the cyberattack in the beginning of August, despite the hack initially taking place December 2013.
According to a company notice posted Wednesday, hackers swiped Social Security numbers and personal data of 10.5 million individuals, making it the third largest HIPAA breach ever reported since the HHS breach notification rule took effect in 2009 -- behind the Anthem and Premera cyberattacks. Other information swiped by hackers included member names, dates of birth, medical claims data, financial account information, addresses and phone numbers.
[Also: Massachusetts HIPAA fine shows the financial risk in healthcare breaches ]
The 10.5 million people who had their data stolen include members, patients and others who did business with the following health plans: BlueCard members; BlueCross BlueShield of Central New York; BlueCross and BlueShield of the Rochester Area; BlueCross BlueShield of Utica-Watertown; and Excellus BCBS.
"We sincerely regret the frustration and concern this incident may cause," wrote Excellus BCBS President and CEO Christopher C. Booth, in a statement. "We want you to know that protecting your information is incredibly important to us, as is helping you through this situation with the information and support you need."
Health plan officials said it would be extending identity theft protection to affected individuals for a two-year period.
[Also: Healthcare finance tips for safeguarding against cyberattacks]
To date, nearly 143.8 million people have had their protected health information compromised in a HIPAA privacy or security breach, according to data from the Department of Health and Human Services. Cyberattacks and hacking-related events have impacted nearly 110 million of that total, close to 77 percent.
The Excellus cyberattack notification comes in the wake of a string of attacks reported this year, the largest being the hack at Anthem, which compromised the data of nearly 79 million people.
This originally appeared on Healthcare IT News. It has been edited.
Twitter: @EMcCannHITN
