DataBreaches.Net

Menu
  • About
  • Breach Notification Laws
  • Privacy Policy
  • Transparency Report
Menu

Magellan ransomware attack impacted multiple subsidiaries and affiliates (UPDATE 2)

Posted on June 26, 2020 by Dissent

On May 12, DataBreaches.net reported that Magellan Health was notifying an unspecified number of individuals as a result of a ransomware attack.  At the time they wrote their notification letter, Magellan stated that investigators had found that a subset of data had been exfiltrated from a single corporate server.

As explained in their first notification letter, the

attack began with a phishing attack on April 6 that impersonated a Magellan client. On April 11, Magellan discovered the breach, and called in Mandiant to investigate. Their investigation revealed that the attackers had exfiltrated a “subset of data from a single Magellan corporate server.”  In “limited instances,” the attacker also used a piece of malware designed to steal login credentials and passwords.

On June 12, Magellan issued another notice and notified HHS of the incident. Their June 12 notice revealed that protected health information had been involved:

The personal information included names and one or more of the following: treatment information, health insurance account information, member ID, other health-related information, email addresses, phone numbers, and physical addresses.  In certain instances, Social Security numbers were also affected.

Their disclosure does not reveal what type of ransomware was deployed or how much ransom was demanded. Nor do they disclose whether they paid any ransom. None of the ransomware threat actors who maintain websites where they reveal their victims who have not paid have claimed any responsibility for the attack on Magellan.

Magellan does not appear to be offering those affected any complimentary services.

Today, HHS added additional reports from Magellan subsidiaries and affiliates. Lilly Ackley, Vice President, Corporate Communications for Magellan Health confirmed to DataBreaches.net that all of the Magellan reports were from the one ransomware incident, but that each entity needed to file its own report. As of the time of this posting, HHS has added the following reports:

  • Magellan Complete Care of Virginia, LLC reported 3,568 of their insured were impacted.
  • Magellan Rx Pharmacy reported 33,040 were impacted.
  • Magellan Healthcare reported as a business associate that 50,410 were impacted.
  • Magellan Complete Care of Florida reported that 76,236 of their insured members were impacted.

So far, then, it appears that 163,254 patients or insured members are being notified. If there are additional reports added, this post will be updated.

Update of June 29:

So there are more affected than reported above. Today DataBreaches.net heard back from UF Health who had submitted three reports to HHS on June 12.  Their spokesperson informs this site that the U Florida Health reports are linked to the Magellan breach reported above impacting UF Health employees enrolled in their health plan. So add the following numbers to the toll for Magellan:

  • UF Health Jacksonville reported 54,002 employees covered by their health plan were impacted;
  • UF Health Shands reported that 13,146 employees covered by their health plan were impacted; and
  • UF reported that 9,182 employees were impacted.

That brings the current total to 239,584.  And at this rate, it seems possible, if not downright likely, that there are other entities who were also impacted by the Magellan ransomware incident.

Update of July 1:

Other entities who had already reported have been linked to the Magellan incident:

  • Merit Health Insurance Co. reported that 102,748 health plan members were impacted; and
  • National Imaging Associates, a business associate, reported hat 22,560 patients were impacted.
  • Buckeye Health Plan disclosed the incident but this is not on HHS’s breach tool at this time, so we do not yet have numbers.

So far, then, the running total or subtotal for the incident sits at 364,892‬.

 

Related posts:

  • TeamGhostShell posts “master list” of 548 leaks (so far)
  • More details emerge on Magellan Healthcare breach
  • Magellan Health notifies employees whose personal data were exfiltrated in a ransomware attack
Category: Health DataMalwareOf NoteU.S.

Post navigation

← New Charges, Sentencing in Satori IoT Botnet Conspiracy
8 U.S. City Websites Targeted in Magecart Attacks →

Now more than ever

"Stand with Ukraine:" above raised hands. The illustration is in blue and yellow, the colors of Ukraine's flag.

Search

Browse by Categories

Recent Posts

  • National Health Care Fraud Takedown Results in 324 Defendants Charged in Connection with Over $14.6 Billion in Alleged Fraud
  • Swiss Health Foundation Radix Hit by Cyberattack Affecting Federal Data
  • Russian hackers get 7 and 5 years in prison for large-scale cyber attacks with ransomware, over 60 million euros in bitcoins seized
  • Bolton Walk-In Clinic patient data leak locked down (finally!)
  • 50 Customers of French Bank Hit by Insider SIM Swap Scam
  • Ontario health agency atHome ordered to inform 200,000 patients of March data breach
  • Fact-Checking Claims By Cybernews: The 16 Billion Record Data Breach That Wasn’t
  • Horizon Healthcare RCM discloses ransomware attack in December
  • Disgruntled IT Worker Jailed for Cyber Attack, Huddersfield
  • Hacker helped kill FBI sources, witnesses in El Chapo case, according to watchdog report

No, You Can’t Buy a Post or an Interview

This site does not accept sponsored posts or link-back arrangements. Inquiries about either are ignored.

And despite what some trolls may try to claim: DataBreaches has never accepted even one dime to interview or report on anyone. Nor will DataBreaches ever pay anyone for data or to interview them.

Want to Get Our RSS Feed?

Grab it here:

https://databreaches.net/feed/

RSS Recent Posts on PogoWasRight.org

  • The Trump administration is building a national citizenship data system
  • Supreme Court Decision on Age Verification Tramples Free Speech and Undermines Privacy
  • New Jersey Issues Draft Privacy Regulations: The New
  • Hacker helped kill FBI sources, witnesses in El Chapo case, according to watchdog report
  • Germany Wants Apple, Google to Remove DeepSeek From Their App Stores
  • Supreme Court upholds Texas law requiring age verification on porn sites
  • Justices nix Medicaid ‘right’ to choose doctor, defunding Planned Parenthood in South Carolina

Have a News Tip?

Email: Tips[at]DataBreaches.net

Signal: +1 516-776-7756

Contact Me

Email: info[at]databreaches.net

Mastodon: Infosec.Exchange/@PogoWasRight

Signal: +1 516-776-7756

DMCA Concern: dmca[at]databreaches.net
© 2009 – 2025 DataBreaches.net and DataBreaches LLC. All rights reserved.