Wellfleet Group, LLC

Wellfleet Group, LLC experienced a data security incident due to a website misconfiguration that allowed medical referral data (PHI) to be indexed by search engines. The issue was discovered on August 1, 2024, and immediately remediated by disabling the misconfiguration and removing public access. No malicious cyber activity was involved. Affected individuals were offered 24 months of credit monitoring.

Wellfleet Group, LLC, a third-party administrator for student health insurance plans, disclosed a data security incident on October 11, 2024. On August 1, 2024, a website misconfiguration allowed deep-links to medical referral pages to be indexed by search engines without authentication. This exposed PHI including names, DOBs, and medical diagnoses. Wellfleet engaged third-party experts, fixed the misconfiguration, and offered 24 months of credit monitoring.

Wellfleet Group, LLC reported a data breach to the Montana Attorney General. The breach was reported on 2024-10-11. The breach occurred on 8/1/2024. 16 Montana residents were affected.

Wellfleet Group, LLC experienced a data security incident due to a website misconfiguration that allowed medical referral pages to be indexed by search engines without authentication. This exposed protected health information (PHI) including names, addresses, dates of birth, and diagnosis codes for students. The issue was discovered on August 1, 2024, and immediately contained by disabling the misconfiguration and removing indexed pages. No malicious cyber activity was involved. Affected individuals were offered 24 months of credit monitoring.

Wellfleet Group, LLC reported to HHS on 2024-10-08 a Unauthorized Access/Disclosure affecting 23,082 individuals. Breached information located on Network Server. A student made PHI (names, birthdates, diagnoses) viewable via the Internet. The CE implemented additional administrative, technical, and security safeguards.