HEALTHEQUITY, INC.

Supplemental notice filed by HealthEquity, Inc. on behalf of Covered Entities (Great Lakes Cheese, Moody's Corporation) regarding a prior data event. 2 New Hampshire residents affected. No new individuals noticed; reflects attribution of previously-noticed individuals.

HealthEquity, Inc. filed a supplemental notice with the New Hampshire Attorney General regarding a data event impacting 108 New Hampshire residents. HealthEquity, acting as a HIPAA Business Associate, reported the breach on behalf of multiple Covered Entities. The incident involved unauthorized access via stolen credentials.

HealthEquity, Inc. reported a data breach involving unauthorized access to personally identifiable information and protected health information via a compromised third-party vendor account. The incident was discovered on March 25, 2024, with the breach occurring on March 9, 2024. Affected data included names, addresses, SSNs, and payment card info. HealthEquity engaged forensic experts, disabled compromised accounts, and offered two years of credit monitoring.

Supplemental notice filed by HealthEquity, Inc. with the New Hampshire Attorney General on May 15, 2025. HealthEquity, a HIPAA Business Associate, reports that one or more Covered Entities had New Hampshire residents impacted by a prior data event. This filing attributes previously noticed individuals to specific Covered Entities, totaling 10,500 residents in NH. The incident involves a third-party supply chain compromise affecting PHI and PII.

HealthEquity, Inc. reported a data security incident where a vendor's user accounts were compromised, leading to unauthorized access to protected health information and personally identifiable information (including SSNs and payment card data) stored in an unstructured data repository. The breach occurred on March 9, 2024, and was discovered on March 25, 2024. HealthEquity engaged third-party experts, disabled compromised accounts, and offered two years of credit monitoring to affected individuals.

HealthEquity, Inc. reported a data security incident where a vendor's user accounts were compromised, leading to unauthorized access to personally identifiable information and protected health information. The breach occurred on March 9, 2024, and was discovered on March 25, 2024. Affected data included names, addresses, SSNs, and payment card information. HealthEquity engaged third-party experts, disabled compromised accounts, and offered two years of credit monitoring.

Supplemental notice filed by HealthEquity, Inc. (HIPAA Business Associate) with NH AG on May 13, 2025. Updates counts for Covered Entities with NH residents impacted by a prior data event. Total NH residents affected in this filing: 638. No new individuals noticed.

Supplemental notice by HealthEquity, Inc. (HIPAA Business Associate) to NH AG regarding a data event impacting New Hampshire residents of various Covered Entities. This filing updates counts for previously noticed individuals. No new individuals are identified.

Supplemental notice filed by HealthEquity, Inc. with the New Hampshire Attorney General on April 25, 2025, reporting 13,157 impacted New Hampshire residents. This filing supplements the original July 26, 2024 notification and reflects completed attributions of previously noticed individuals.

HealthEquity, Inc. reported a data security incident where a vendor's user accounts were compromised, leading to unauthorized access to protected health information and personally identifiable information (including SSNs and payment card data) stored in an unstructured data repository. The breach occurred on March 9, 2024, and was discovered on March 25, 2024. HealthEquity engaged third-party experts, disabled compromised accounts, and offered two years of credit monitoring to affected individuals.

Supplemental notice filed by HealthEquity, Inc. (a HIPAA Business Associate) on behalf of Covered Entities in New Hampshire. This filing updates the count of NH residents affected by a prior data event, attributing 105 individuals to three specific entities: Ameritas Life Insurance Corp (16), BCBS Massachusetts (87), and Regence BCBS (2).

Supplemental notice filed by HealthEquity, Inc. (HIPAA Business Associate) on behalf of Covered Entity Anthem regarding a prior data event impacting 3,229 New Hampshire residents. This filing updates the count of previously-noticed individuals attributed to Anthem.

HealthEquity, Inc. reported a data security incident where a vendor's user accounts were compromised, leading to unauthorized access to personally identifiable information and protected health information. The breach occurred on March 9, 2024, and was discovered on March 25, 2024. Affected data includes names, addresses, SSNs, and payment card info. HealthEquity engaged third-party experts, disabled compromised accounts, and offered two years of credit monitoring.

Supplemental notice filed by HealthEquity, Inc. (HIPAA Business Associate) with the New Hampshire Attorney General on April 9, 2025. This filing updates the July 26, 2024 breach notification, attributing impacted New Hampshire residents to specific Covered Entities. The breach involved unauthorized access to a third-party vendor's systems, affecting PII and government IDs of employees/beneficiaries across numerous organizations.

HealthEquity, Inc. reported unauthorized access to an unstructured data repository containing PHI and PII of HSA/FSA plan participants. The anomaly was detected on March 25, 2024, following a vendor alert. Forensic investigation confirmed unauthorized access and potential disclosure. HealthEquity is a third-party administrator for healthcare benefits.

HealthEquity, Inc. reported a data breach affecting HSA/FSA customers. On March 25, 2024, the company detected a systems anomaly. Investigation revealed that a third-party vendor's user accounts were compromised, allowing unauthorized access to an online data storage location containing personally identifiable information (PII) and protected health information (PHI), including names, addresses, SSNs, and payment card info (but not numbers). The breach occurred on March 9, 2024. HealthEquity disabled compromised accounts, reset passwords, and offered two years of credit monitoring.

HealthEquity, Inc. reported to HHS on 2024-12-20 a Hacking/IT Incident affecting 1549 individuals. Breached information located on Network Server. Business Associate present.

Health Equity Inc reported a data breach to the Indiana Attorney General. 1 Indiana residents were affected. 2 individuals affected in total.

HealthEquity, Inc. reported to HHS on 2024-08-09 a Hacking/IT Incident affecting 4300000 individuals. Breached information located on Network Server.

Health Equity Inc reported a data breach to the Indiana Attorney General. The breach occurred on 2024-03-13 and was reported on 2024-07-29. 98,857 Indiana residents were affected. 4,300,000 individuals affected in total.

HealthEquity, Inc. experienced an external system breach on March 9, 2024, which was discovered on June 26, 2024. The breach affected 13,480 Maine residents. The company is offering two years of complimentary credit and identity monitoring services through Equifax to those affected.

HealthEquity, Inc. reported a data breach to the Oregon Attorney General. The breach was reported on 2024-07-26. The breach occurred during 3/9/2024 - 3/25/2024. The breach was discovered on 6/26/2024. 4,300,000 individuals were affected. Notice was sent on 7/29/2024.

HealthEquity, Inc. notified consumers of a data breach where a third-party vendor's compromised accounts led to unauthorized access to an unstructured data repository. The incident, discovered on March 25, 2024, exposed PII including names, addresses, SSNs, and financial account info. HealthEquity engaged forensic experts, disabled compromised accounts, and offered two years of credit monitoring.

HealthEquity Inc reported a data breach to the Montana Attorney General. The breach was reported on 2024-07-26. The breach occurred on 3/25/2024. 17,606 Montana residents were affected.

HealthEquity, Inc. reported unauthorized access to personal information via a compromised third-party vendor account. The incident was discovered on March 25, 2024, with the breach occurring on March 9, 2024. Affected data included names, addresses, SSNs, and payment card info. HealthEquity engaged forensic experts, disabled compromised accounts, and offered two years of credit monitoring.