Attorney General Richard Blumenthal said today his office is investigating a data breach by health insurer Health Net, which led to the loss of almost 450,000 Connecticut residents’ health, personal and financial information.
Blumenthal said Health Net lost the information in May, but never informed consumers, the police or his office about the loss of information until today.
He said the six-month delay in giving notice to consumers and the state could be a violation of the law.
“I am outraged and appalled by Health Net’s huge loss of personal, financial and medical information and its failure to swiftly inform authorities and consumers,” Blumenthal said. “This information vanished six months ago, but Health Net is only now informing authorities and consumers, an inexcusable and inexplicable delay.”
Blumenthal said the information was on a hard drive that disappeared from Health Net’s Shelton office. The hard drive included all data on 446,000 Connecticut patients, including health information, as well as financial and personal data such as social security and bank account numbers. The data was compressed, but not encrypted, although a specialized computer program is required to read it.
Alice Ferreira, a spokeswoman for Health Net, said they were initially unable to determine what information was on the lost drive, forcing the company conduct a lengthy investigation, which included a detailed forensic review by computer experts.
“Protecting the privacy of our members is extremely important to us,” the company said in a statement. “We apologize for any inconvenience or concern this may cause our members.”
To date, the company said it has not had any reports of misused data.
However, Health Net will provide credit monitoring for over two years – free of charge – to all impacted members who elect the service, and will provide assistance to any member who has experienced any suspicious activity, identity theft or health care fraud between May 2009 and their date of enrollment.
Blumenthal said he will demand Health Net provide consumers with comprehensive, long-term identity theft protection.
“My investigation will seek to establish what happened and why the company kept its customers and the state in the dark for so long,” Blumenthal added. “The company’s failure to safeguard such sensitive information and inform consumers of its loss — leaving them naked to identity theft — may have violated state and federal laws. I will vigorously and aggressively seek damages, penalties and other appropriate remedies, if warranted.”
Â
Â
