Mass General Brigham Health Plan

Mass General Brigham Health Plan, Inc. reported a ransomware attack on June 27, 2024, affecting approximately 1 million individuals. The incident involved data encryption and exfiltration. PHI, names, and government IDs were compromised. The company engaged forensic investigators and notified law enforcement.

Mass General Brigham Health Plan reported to HHS on 2024-06-28 a Unauthorized Access/Disclosure affecting 3,659 individuals. Breached information located on Other. An employee impermissibly shared system credentials with an unauthorized individual, exposing PHI including names, addresses, SSNs, and medical data. The CE provided credit monitoring, established a call center, sanctioned the employee, and retrained staff.

Mass General Brigham Health Plan notified consumers of an insider incident where an employee allowed an unauthorized person to access member data between July 2023 and April 2024. Data included names, SSNs, DOBs, and PHI. The employee was terminated, and 24 months of credit monitoring were offered.