- State
- CT
- Covered entity type
- Health Plan
- Individuals affected
- 2,030
- Business associate present
- Yes
- Type of breach
- Hacking/IT Incident
- Location of breached information
- First seen by InfoSec Signals
- 9/23/2026
- Last seen in OCR export
- 9/23/2026
OCR description
On October 11, 2018, a business associate (BA), BenefitMall, discovered a phishing attack which affected the protected health information (PHI) of 2,030 of the covered entity’s (CE) individual members, including demographic, financial, and health plan information. The BA notified the CE of the breach on December 11, 2018, and the CE provided breach notification to HHS, affected individuals, and the media. OCR reviewed the CE’s policies, procedures, and the executed BA agreement as it relates to this breach. The policies appear to be in compliance with the Privacy Rule. As a result of the breach, the BA implemented two-factor authentication and retrained employees.
Change history
- 9/23/2026Added to OCR's archive list
Source: HHS OCR Breach Portal, U.S. Department of Health and Human Services, Office for Civil Rights about this source
Records are reproduced as published; entity names and figures are OCR's.