The Rhode Island Attorney General is investigating UnitedHealthcare and the Rhode Island Public Transit Authority (RIPTA) over a cyberattack and data breach that resulted in hackers gaining access to RIPTA’s network that contained the sensitive personal and protected health information of up to 22,000 individuals.
The Office of the Rhode Island Attorney General was notified about the security breach on December 23, 2021. RIPTA said it discovered and blocked a cyberattack on August 5, 2021, with its investigation confirming the hackers gained access to its network on August 3, 2021. Files stored on the compromised part of its network included extensive information on its employees, including names, dates of birth, Social Security numbers, and health plan ID numbers, along with the sensitive information of thousands of state employees who had never worked at RIPTA.
RIPTA reported the breach to the HHS’ Office for Civil Rights as affecting 5,015 individuals but said in its breach notice that the incident had resulted in the exposure of the personal data of 17,378 individuals. The difference in the numbers was due to UnitedHealthcare, RIPTA’s previous health insurance provider, providing RIPTA with files containing the data of non-RIPTA employees. In total, up to 22,000 individuals had their sensitive data stolen in the attack. The files were stored on RIPTA’s servers and were not encrypted and the hackers exfiltrated approximately 40,000 files from RIPTA’s systems.
RIPTA sent notification letters to affected individuals, including those that had no association with RIPTA, triggering a barrage of complaints to the Office for the Attorney General questioning why their personal data had been compromised in a breach at RIPTA when they had never had any association with the quasi-public agency. The delay in issuing notification letters was due to each of those 40,000 files having to be manually searched, which was a labor-intensive and time-consuming process. RIPTA said only a small number of people were involved in the document review to prevent sensitive data from being further exposed.
On Monday this week, RIPTA administrators testified under oath at a Senate oversight committee hearing about the incident. RIPTA Chief Legal Counsel Steven Colantuono said at the hearing, “We don’t believe that anyone did anything wrong on our end, but we are still investigating it.”
RIPTA Director Scott Avedisian confirmed that reports downloaded by RIPTA from a UnitedHealthcare portal between 2015 and 2020 were ‘filtered files’, and the data unrelated to RIPTA was supposed to remain hidden. While not confirmed, the description suggests the downloaded files were Excel spreadsheets with certain rows hidden. The secure links to access the files on the portal were emailed to RIPTA by UnitedHealthcare.
At the hearing, officials at the state Department of Information Technology confirmed there is a statewide policy requiring the encryption of sensitive data such as personally identifiable information, personal health information, and federal tax information; however, RIPTA is not one of the agencies or quasi-state agencies assisted or supported by the Department of Information Technology, so RIPTA is not required to comply with the state’s encryption policy.
UnitedHealthcare’s VP of external affairs was scheduled to appear at the hearing but backed out after initially agreeing to appear. UnitedHealthcare said it is investigating the breach to determine what went wrong. At this stage, there is no listing of a breach at UnitedHealthcare on the HHS’ Office for Civil Rights breach portal.
In addition to the investigation by the Rhode Island Attorney General, Colantuono said there will also be a federal investigation and discussions are currently being had between the Department of Justice and the HHS’ Office for Civil Rights to determine which of the two agencies will be conducting the investigation. There is also the possibility of legal action being taken against UnitedHealthcare and RIPTA by state employees affected by the data breach.
The post RI Attorney General Subpoenas RIPTA and UnitedHealthcare Over 22,000-Record Data Breach appeared first on HIPAA Journal.