On May 12, DataBreaches.net reported that Magellan Health was notifying an unspecified number of individuals as a result of a ransomware attack. At the time they wrote their notification letter, Magellan stated that investigators had found that a subset of data had been exfiltrated from a single corporate server.
As explained in their first notification letter, the
attack began with a phishing attack on April 6 that impersonated a Magellan client. On April 11, Magellan discovered the breach, and called in Mandiant to investigate. Their investigation revealed that the attackers had exfiltrated a “subset of data from a single Magellan corporate server.” In “limited instances,” the attacker also used a piece of malware designed to steal login credentials and passwords.
On June 12, Magellan issued another notice and notified HHS of the incident. Their June 12 notice revealed that protected health information had been involved:
The personal information included names and one or more of the following: treatment information, health insurance account information, member ID, other health-related information, email addresses, phone numbers, and physical addresses. In certain instances, Social Security numbers were also affected.
Their disclosure does not reveal what type of ransomware was deployed or how much ransom was demanded. Nor do they disclose whether they paid any ransom. None of the ransomware threat actors who maintain websites where they reveal their victims who have not paid have claimed any responsibility for the attack on Magellan.
Magellan does not appear to be offering those affected any complimentary services.
Today, HHS added additional reports from Magellan subsidiaries and affiliates. Lilly Ackley, Vice President, Corporate Communications for Magellan Health confirmed to DataBreaches.net that all of the Magellan reports were from the one ransomware incident, but that each entity needed to file its own report. As of the time of this posting, HHS has added the following reports:
- Magellan Complete Care of Virginia, LLC reported 3,568 of their insured were impacted.
- Magellan Rx Pharmacy reported 33,040 were impacted.
- Magellan Healthcare reported as a business associate that 50,410 were impacted.
- Magellan Complete Care of Florida reported that 76,236 of their insured members were impacted.
So far, then, it appears that 163,254 patients or insured members are being notified. If there are additional reports added, this post will be updated.
Update of June 29:
So there are more affected than reported above. Today DataBreaches.net heard back from UF Health who had submitted three reports to HHS on June 12. Their spokesperson informs this site that the U Florida Health reports are linked to the Magellan breach reported above impacting UF Health employees enrolled in their health plan. So add the following numbers to the toll for Magellan:
- UF Health Jacksonville reported 54,002 employees covered by their health plan were impacted;
- UF Health Shands reported that 13,146 employees covered by their health plan were impacted; and
- UF reported that 9,182 employees were impacted.
That brings the current total to 239,584. And at this rate, it seems possible, if not downright likely, that there are other entities who were also impacted by the Magellan ransomware incident.
Update of July 1:
Other entities who had already reported have been linked to the Magellan incident:
- Merit Health Insurance Co. reported that 102,748 health plan members were impacted; and
- National Imaging Associates, a business associate, reported hat 22,560 patients were impacted.
- Buckeye Health Plan disclosed the incident but this is not on HHS’s breach tool at this time, so we do not yet have numbers.
So far, then, the running total or subtotal for the incident sits at 364,892.