Bosch Choice Welfare Benefit Plan reports data breach affecting 55,000 members

Bosch Choice Welfare Benefit Plan disclosed a data breach to the U.S. Department of Health and Human Services on Oct. 31, 2025, after unauthorized access to systems exposed sensitive personal and health information belonging to approximately 55,000 individuals in the United States.

The Bosch Choice Welfare Benefit Plan is a flexible employee benefits program serving Bosch employees nationwide, offering health, dental, vision, life, and disability insurance coverage. The breach did not occur within Bosch’s own systems but stemmed from a cybersecurity incident involving a vendor connected to one of the plan’s business associates.

Information made available through the federal health department’s data breach portal shows that the incident involved unauthorized access to systems containing highly sensitive data. The compromised information included names, Social Security numbers, dates of birth, health insurance details, medical claims data, and information related to diagnoses or medical conditions.

The Office for Civil Rights, which oversees compliance with federal health information privacy regulations, reviewed the incident and closed its investigation shortly after the breach notification was filed. The federal disclosure indicates that the same incident affected additional covered entities beyond the Bosch employee health plan, although the business associate involved has not been publicly identified.

The business associate responsible for the affected systems has notified the impacted health plans and is in the process of issuing notifications to affected individuals. Additional technical safeguards have been implemented to strengthen the protection of protected health information maintained by the vendor.

Although the breach originated outside Bosch’s direct infrastructure, the Bosch Choice Welfare Benefit Plan elected to report the incident directly to federal regulators. Details regarding the specific cause of the cybersecurity incident and the timeline of unauthorized access have not been publicly released.