HealthEquity says data breach is an ‘isolated incident’ | TechCrunch

On Tuesday, well being tech services and products supplier HealthEquity disclosed in a submitting with federal regulators that it had suffered a knowledge breach, through which hackers stole the “safe well being data” of a few consumers. 

In an 8-K filing with the SEC, the corporate mentioned it detected “anomalous conduct through a non-public use software belonging to a trade spouse,” and concluded that the spouse’s account were compromised through somebody who then used the account to get admission to participants’ data.

On Wednesday, HealthEquity disclosed extra main points of the incident with Techmim. HealthEquity spokesperson Amy Cerny mentioned in an electronic mail that this was once “an remoted incident” that isn’t hooked up to different contemporary breaches, such as that of Change Healthcare, owned through the healthcare large UnitedHealth. In Might, UnitedHealth CEO Andrew Witty mentioned in a Area listening to that the breach affected “maybe a third” of all Americans.

HealthEquity detected the breach on March 25, when it “took quick motion, resolved the problem, and started in depth information forensics, which have been finished on June 10.” The corporate introduced in combination “a workforce of outdoor and inner mavens to analyze and get ready for reaction.” The investigations decided that the breach was once because of the compromised third-party seller account gaining access to “a few of HealthEquity’s SharePoint information,” in step with Cerny.

SharePoint is a collection of Microsoft gear that permits corporations to create web sites, in addition to retailer and proportion inner data — essentially an intranet.

Cerny additionally mentioned that “transactional methods, the place integrations happen, weren’t impacted,” and that the corporate is notifying companions, purchasers and participants, and has been operating with regulation enforcement in addition to mavens to paintings on fighting long term incidents. 

Techmim requested Cerny to specify what for my part identifiable and “safe well being” data was once stolen on this breach, what number of people were affected and what spouse was once concerned. Cerny declined to reply to all of those questions. 

Previous this yr, HealthEquity reported that the corporate and its subsidiaries “administer HSAs and different CDBs for our greater than 15 million accounts in partnership with employers, advantages advisers, and well being and retirement plan suppliers.”