WORLDWIDE INSURANCE SERVICES, LLC

Worldwide Services Insurance Agency, LLC (doing business as GeoBlue) reported a data breach affecting international health insurance plan enrollees. Between October 11 and 13, 2017, unauthorized parties obtained employee email credentials via a phishing scheme. The attacker may have accessed emails containing enrollee names. No evidence of misuse was found. Remediation included forensic investigation, employee phishing training, enhanced email security software, and MFA implementation. Affected individuals were offered one year of Experian IdentityWorks.

Worldwide Insurance Services, LLC (PA) reported to HHS OCR on 2018-04-30 a Hacking/IT Incident affecting 1,692 individuals. An unauthorized user gained access to employee email accounts via a phishing attack. PHI exposed included patients' names, dates of birth, Social Security numbers, claims information, clinical information, and financial information. Breached information was located in Email. In response, the entity upgraded email encryption, implemented MFA, and trained employees on phishing threats. OCR provided technical assistance on timely breach notifications.