Capitol Administrators, Inc

Capitol Administrators, Inc. (a Business Associate in CA) reported to HHS on 2018-05-11 a Hacking/IT Incident affecting 1,733 individuals. An external third party accessed employees' email accounts via a suspected phishing incident, compromising demographic and clinical PHI. The BA notified client health plans, HHS, affected individuals, and media, and offered free credit monitoring. Remediation included password changes, MFA implementation, blocking foreign IP addresses, and enhanced phishing training. Breached information located on Email.

Capitol Administrators, Inc. reported a data breach resulting from a phishing email incident. On March 30, 2018, the company discovered that an unauthorized individual had accessed emails and attachments in a small number of employee accounts. The breach window was identified as January 7–24, 2018. Affected data included names and personal/medical information of plan participants. Capitol engaged a cybersecurity firm, secured accounts, implemented MFA, and offered one year of identity monitoring via Kroll.