SAG-AFTRA Health Plan

SAG-AFTRA Health Plan notified consumers of a phishing incident compromising an employee's email account between Sept 17-18, 2024. The breach exposed names, SSNs, and health insurance information for participants and dependents. The Plan contained the incident, engaged forensic experts, notified law enforcement, and offered one year of Experian IdentityWorks.

SAG-AFTRA Health Plan submitted a supplemental notice to the New Hampshire Attorney General regarding a cybersecurity incident. An employee's email account was compromised via phishing between September 17-18, 2024. The incident exposed personal information of 112 New Hampshire residents. The Plan contained the incident, engaged third-party experts, notified law enforcement, and offered credit monitoring services.

SAG-AFTRA Health Plan notified California residents that an employee's email account was compromised via phishing between Sept 17-18, 2024. The unauthorized party accessed emails containing names, SSNs, and health insurance claim information for participants, spouses, and dependents. The incident was contained immediately. The Plan engaged third-party experts, notified law enforcement, and is offering one year of complimentary identity theft protection through Experian.

SAG-AFTRA Health Plan reported a data breach to the Oregon Attorney General. The breach was reported on 2025-03-14. The breach occurred during 9/17/2024 - 9/18/2024. The breach was discovered on 2/7/2025. 95,104 individuals were affected. Notice was sent on 3/14/2025.

SAG-AFTRA Health Plan reported a phishing incident where an employee's email account was compromised between Sept 17-18, 2024. The breach exposed names, SSNs, and potentially PHI of 937 Washington residents. The Plan contained the incident, engaged third-party experts, notified law enforcement, and mailed notifications on March 14, 2025, offering one year of credit monitoring.

SAG-AFTRA Health Plan, a financial services/insurance entity filed a data breach notification with the Nebraska Attorney General. The breach was discovered on 2024-10-03 according to the AG's register. The breach is dated 2024-09-17 to 2024-09-18. Nebraska residents were notified on 2024-12-02.

SAG-AFTRA Health Plan reported to HHS on 2024-12-02 a Hacking/IT Incident affecting 98,474 individuals. Breached information located on Email. An employee was targeted by an email phishing scheme, exposing names, SSNs, and claims information. The entity implemented additional safeguards and retrained staff.

SAG-AFTRA Health Plan notified the New Hampshire Attorney General of a security incident where an employee's email account was compromised via phishing between Sept 17-18, 2024. The breach exposed personal and health information of 38 NH residents. The Plan contained the incident, engaged third-party experts, notified law enforcement, and offered credit monitoring services.

SAG-AFTRA Health Plan notified Montana residents of a phishing incident where an employee's email account was compromised. Unauthorized access occurred Sept 17-18, 2024, exposing names, SSNs, and potentially PHI. The Plan contained the incident, engaged third-party experts, and notified law enforcement. Affected individuals are offered one year of Experian IdentityWorks.

SAG-AFTRA Health Plan experienced a data breach after an employee's email account was compromised via a phishing email. Unauthorized access occurred between September 17 and 18, 2024. The incident exposed personal information including names, Social Security numbers, and potentially health insurance claims data for some plan participants. The Plan contained the incident, engaged third-party experts, notified law enforcement, and is offering one year of identity theft protection to affected individuals.

SAG-AFTRA Health Plan reported a data breach to the Massachusetts Office of Consumer Affairs and Business Regulation. The breach was reported on 2024-12-02. 991 Massachusetts residents were affected.

SAG-AFTRA HEALTH PLAN filed a data-breach notice with the Illinois Attorney General in December 2024 (case 24-12-001). The register records the breach as discovered on September 17, 2024. Illinois does not publish the number of people affected — 815 ILCS 530/10 permits the Attorney General to publish only the entity name, the types of personal information and the date range.