Health tech company HealthEquity says vendor data breach compromised customer records

U.S. healthcare fintech company HealthEquity said it experienced a data security incident that compromised the sensitive personal information of its clients.

 

In a filing with the US Security and Exchange Commission, HealthEquity said it recently detected “anomalous behaviour by a personal use device belonging to a business partner.” The company said it launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

 

“The investigation concluded that the Partner’s user account had been compromised by an unauthorised third party, who used that account to access information,” reads the SEC filing. The compromised data included some personally identifiable information, and protected health information.

 

“The investigation further concluded that some information was subsequently transferred off the Partner’s systems. The Company has taken steps to strengthen its security environment, including with respect to the compromised Partner account and the recommended actions of its incident response firm,” HealthEquity explained.

 

HealthEquity added that the threat actors who infiltrated the network did not place any malware and there has been no disruption to the company’s systems, services, or business operations.

 

“The Company is in the process of notifying its partners and clients, as well as identifying and notifying individual members whose information may have been involved.

 

“The Company does not currently believe the incident will have a material adverse effect on its business, operations, or financial results. The Company is continuing to evaluate the impact of this incident, including remediation expenses and other potential liabilities. The Company believes it holds adequate cybersecurity insurance for this incident and will also be seeking recourse from the Partner,” the company added.

 

HealthEquity also stated that it will provide credit monitoring and identity protection services to affected individuals once its investigation is completed.