HEALTHEQUITY, INC.

Supplemental notice filed by HealthEquity, Inc. (HIPAA Business Associate) on behalf of Covered Entity Anthem regarding a prior data event impacting 3,229 New Hampshire residents. This filing updates the count of previously-noticed individuals attributed to Anthem.

Affected (this filing): 3,229

HealthEquity, Inc. reported a data security incident where a vendor's user accounts were compromised, leading to unauthorized access to protected health information and personally identifiable information (including SSNs and payment card data) stored in an unstructured data repository. The breach occurred on March 9, 2024, and was discovered on March 25, 2024. HealthEquity engaged third-party experts, disabled compromised accounts, and offered two years of credit monitoring to affected individuals.

Supplemental notice filed by HealthEquity, Inc. (a HIPAA Business Associate) on behalf of Covered Entities in New Hampshire. This filing updates the count of NH residents affected by a prior data event, attributing 105 individuals to three specific entities: Ameritas Life Insurance Corp (16), BCBS Massachusetts (87), and Regence BCBS (2).

Affected (this filing): 105

Supplemental notice by HealthEquity, Inc. (HIPAA Business Associate) to NH AG regarding a data event impacting New Hampshire residents of various Covered Entities. This filing updates counts for previously noticed individuals. No new individuals are identified.

Affected (this filing): 1,088

Supplemental notice filed by HealthEquity, Inc. (HIPAA Business Associate) with NH AG on May 13, 2025. Updates counts for Covered Entities with NH residents impacted by a prior data event. Total NH residents affected in this filing: 638. No new individuals noticed.

Affected (this filing): 638

Supplemental notice filed by HealthEquity, Inc. with the New Hampshire Attorney General on May 15, 2025. HealthEquity, a HIPAA Business Associate, reports that one or more Covered Entities had New Hampshire residents impacted by a prior data event. This filing attributes previously noticed individuals to specific Covered Entities, totaling 10,500 residents in NH. The incident involves a third-party supply chain compromise affecting PHI and PII.

Affected (this filing): 10,500

HealthEquity, Inc. reported a data security incident where a vendor's user accounts were compromised, leading to unauthorized access to protected health information and personally identifiable information (including SSNs and payment card data) stored in an unstructured data repository. The breach occurred on March 9, 2024, and was discovered on March 25, 2024. HealthEquity engaged third-party experts, disabled compromised accounts, and offered two years of credit monitoring to affected individuals.

HealthEquity, Inc. filed a supplemental notice with the New Hampshire Attorney General regarding a data event impacting 108 New Hampshire residents. HealthEquity, acting as a HIPAA Business Associate, reported the breach on behalf of multiple Covered Entities. The incident involved unauthorized access via stolen credentials.

Affected (this filing): 108

HealthEquity, Inc. reported a data breach involving unauthorized access to personally identifiable information and protected health information via a compromised third-party vendor account. The incident was discovered on March 25, 2024, with the breach occurring on March 9, 2024. Affected data included names, addresses, SSNs, and payment card info. HealthEquity engaged forensic experts, disabled compromised accounts, and offered two years of credit monitoring.

Supplemental notice filed by HealthEquity, Inc. on behalf of Covered Entities (Great Lakes Cheese, Moody's Corporation) regarding a prior data event. 2 New Hampshire residents affected. No new individuals noticed; reflects attribution of previously-noticed individuals.

Affected (this filing): 2