On June 8, Choice Health Insurance began notifying people of a data breach caused by human error. According to their notification to the California Attorney General’s Office, they learned on May 14 that an unauthorized person was “offering to make
available data allegedly taken from Choice Health.”
In actuality, on May 9, the data had been first offered for sale on a popular hacking forum.
The forum listing provided the headers of the fields in the database, and also provided some data from the database (not shown in the image above).
DataBreaches reached out to the Telegram account listed in the forum post on May 9 to inquire whether the data were new or old. The person handling the sale for them stated that they had just gotten the data two days earlier — on or about May 7.
Choice Health’s notification states that on May 18, 2022, they determined that, “due to a technical security configuration issue caused by a third-party service provider, a single Choice Health database was accessible through the Internet. Based on our investigation, an unauthorized individual accessed the database from the Internet and obtained certain database files on or about May 7, 2022.”
Their statement is consistent with what DataBreaches was told in the Telegram chat.
According to Choice Health’s notification, the types of data involved included “first and last name, Social Security number; Medicare beneficiary identification number; date of birth; address and contact information; and health insurance information.”
Choice Health’s notice does not indicate how many people they are notifying, and the incident has not yet appeared on HHS’s breach tool, so we do not have any confirmed number affected. The forum listing, however, claimed to have 600MB of data with 2,141,006 files described as “Agents, Commission, Contacts, Policies.” The number of files may not represent the number of unique individuals with personally identifiable information or protected health information.
Choice Health is offering those affected a complimentary 24-month membership of Experian IdentityWorksSM.
As always, human error is a major contributor to data breaches. Once again, there was no need to hack when data was leaking and out there for the taking or scraping.
Note: Choice Health is now an Alight Solutions company.