WebTPA, a prominent provider of administrative services for health plans and insurers, has disclosed a significant data breach that exposed the personal information of over 2.4 million individuals. The breach occurred between April 18 and April 23, 2023, with details emerging from an undated website notice and notifications to affected parties.
The compromised data includes names, birth and death dates, Social Security numbers, contact details, and insurance information. Notably, financial account information, credit card numbers, and medical treatment or diagnostic data were not affected. WebTPA discovered suspicious activity on its network in late December 2023, prompting an investigation that confirmed the data exposure.
WebTPA President Lisa Tranberg emphasized the limited impact of the breach, noting that there have been no reports of misuse of the compromised information. Nonetheless, the company is offering two years of credit monitoring, identity theft protection, and fraud consultation services through Kroll to affected individuals, available until August 1.
The breach has impacted customers from several major insurance companies, including The Hartford, Transamerica, and Gerber Life Insurance. Notifications were sent to these insurance firms and benefit plans by late March, with individual notifications following in early May.
This incident is part of a troubling trend of cyberattacks targeting healthcare-related entities, including Australian e-prescription service MediSecure, the Ascension health system, and Change Healthcare.
WebTPA, a subsidiary of GuideWell Mutual Holding Corporation, employs 18,000 people and generates $103 million in annual revenue. As the company addresses the breach’s aftermath, it advises affected individuals to remain vigilant for potential fraud attempts and to regularly review their credit reports. WebTPA also recommends placing a security freeze on credit files to prevent unauthorized access.
