Quarter of a Million Patients Notified After Healthcare Data Breaches in New Jersey and Texas
Clover Health Investments and AngMar Management Services are alerting over 250,000 people after hackers stole sensitive health and personal data in separate July breaches.
Ross GrantUpdated 3 min read
The short version
Two healthcare companies in New Jersey and Texas had data breaches in July. Hackers stole sensitive information like names, birth dates, and medical details from over 250,000 people. Both companies are now alerting affected patients. If you get a notice, keep an eye on your accounts and watch for scams.
By the numbers
- 250,000+people affected by both breachesSecurityWeek
- 138,677Clover Health breach victimsSecurityWeek
- 126,196AngMar Management Services breach victimsSecurityWeek
- 700 GBdata stolen from AngMar (claimed by Interlock ransomware group)SecurityWeek
What happened?
Hackers stole personal and medical data from Clover Health Investments and AngMar Management Services in July. Over 250,000 people are being notified. Both companies reported the breaches to US regulators. The Interlock ransomware group claimed responsibility for the AngMar attack.
Two Healthcare Firms Hit by Data Breaches
Two healthcare companies, Clover Health Investments in New Jersey and AngMar Management Services in Texas, are notifying more than 250,000 people that their personal and medical information was stolen by hackers. Both incidents were reported to the US Department of Health and Human Services (HHS) and have now been added to the HHS data breach portal, according to SecurityWeek (opens in a new tab).
What Was Taken
For Clover Health Investments, attackers accessed employee accounts in early July using social engineering. The company said in an SEC filing that the stolen data includes names, dates of birth, insurance identifiers, and account identification numbers. In total, 138,677 people were affected.
AngMar Management Services, which supports home health and hospice care providers, found suspicious activity in mid-July and confirmed in September that hackers had stolen patient data. The stolen information is more extensive: names, birth dates, Social Security numbers, diagnosis details, medical history, health insurance information, patient IDs, provider names, prescription details, and dates of service. AngMar reported 126,196 people affected.
How the Attacks Happened
Clover Health's breach started with social engineering, a technique where attackers trick people into giving up access or information. In this case, three non-managerial employee accounts were compromised. The company has not said exactly how the attackers convinced staff to hand over credentials or access.
For AngMar, the Interlock ransomware group claimed responsibility and listed the company on its leak site in August, saying it had stolen over 700 gigabytes of data. The company confirmed the breach in early September after investigating the suspicious activity.
Who Is Affected and What Should You Do?
Patients and health plan members whose data was stolen could face risks like identity theft or fraud. The most sensitive information, such as Social Security numbers and medical histories, was taken from AngMar. Both companies are notifying affected people. If you receive a notice, watch for suspicious activity on your accounts, consider credit monitoring, and be alert for phishing attempts using your stolen details.
What Happens Next
Both companies have reported the breaches to HHS, which is standard for US healthcare data incidents affecting more than 500 people. The companies may face regulatory scrutiny and possible fines. Under US law, healthcare organisations must notify affected individuals and report large breaches to regulators. There is no public statement yet on whether ransom was paid or if law enforcement is involved.
What Is Still Unclear
So far, only SecurityWeek has reported these breaches. There are no statements from the companies or HHS beyond the breach portal entries. The exact method of social engineering at Clover Health and the full impact of the AngMar breach are not yet known. Details may change as more information becomes available.
Claimed vs confirmed
- Unconfirmed
Interlock ransomware group stole over 700GB from AngMar Management Services.
Interlock group made this claim on its leak site. AngMar confirmed a breach but not the amount.
The impact
- Money
- Both companies could face regulatory fines. In the US, healthcare data breaches can lead to significant penalties under HIPAA if organisations are found negligent.
- Reputation
- Trust in both companies may be damaged, especially as sensitive health data was exposed. The incidents are now public and listed on the HHS breach portal.
- Customers
- Patients whose data was stolen should be alert for identity theft, scams, and fraudulent use of their information. Both companies are notifying affected individuals.
Why it matters
Healthcare data is highly sensitive and valuable to criminals. Patients whose information was stolen could be at risk of identity theft, fraud, or targeted scams. These breaches also highlight the ongoing risks facing healthcare organisations and the importance of strong security practices.
How does it work?
Social engineering was used to compromise employee accounts at Clover Health. This usually means tricking staff into revealing passwords or clicking malicious links. The AngMar breach involved ransomware, where attackers steal data and threaten to leak it unless paid.
Key points
- Two US healthcare firms reported data breaches affecting over 250,000 people.
- Clover Health's breach involved social engineering of employee accounts.
- AngMar Management Services' breach was linked to the Interlock ransomware group.
- Stolen data includes names, birth dates, Social Security numbers, and medical details.
- Patients should watch for identity theft and scams if notified.
Sources
SecurityWeek
Reference
