The 20/20 Hearing Care Network has started notifying millions of current and former members that some of their protected health information (PHI) has potentially been compromised and/or deleted.
On January 11, 2021, suspicious activity was detected in its AWS cloud storage environment. Steps were immediately taken to prevent further unauthorized access and an investigation was launched to determine the nature and scope of the security breach. Third party forensics experts assisted with the investigation and confirmed that S3 buckets hosted in AWS had been accessed, data in those buckets downloaded, and then all data in the S3 buckets was deleted.
The forensic investigation confirmed in late February that some of the data downloaded and deleted from the storage environment included PHI for some or all health plan members for whom records were held. While data theft was confirmed, it was not possible to tell exactly which information had been accessed or removed from the S3 buckets. The types of data potentially obtained in the attack included names, Social Security numbers, dates of birth, member ID numbers, and health insurance information.
Starting on or around May 28, 2021, notification letters were sent to all individuals potentially affected. As a precaution against misuse of member information, certain affected individuals have been offered complimentary credit monitoring and identity theft protection services.
20/20 said in its breach notice that while data theft was confirmed, it does not believe there has been any misuse of member data. The report filed with the Maine Attorney General classes this incident as ‘insider wrongdoing’.
Following the breach, 20/20 conducted a robust review of policies and procedures and has taken steps to improve security to prevent similar breaches in the future.
The breach has been reported to the Maine Attorney General as affecting up to 3,253,822 individuals, making this one of the largest healthcare data breaches to be discovered this year.
The post More than 3.2 Million Individuals Affected by 20/20 Hearing Care Network Data Breach appeared first on HIPAA Journal.