Impersonation scam at Sunshine Health compromises data of over 40,000 people

Sunshine Health, a Florida-based health insurance provider, has disclosed that a data security incident earlier this year exposed the sensitive personal information of more than 40,000 individuals.

Sunshine Health is a managed healthcare company that provides health insurance through Medicaid, Medicare Advantage, and Affordable Care Act Marketplace plans. A subsidiary of Centene Corporation, the insurer serves residents across Florida by offering access to a network of healthcare providers, hospitals, and pharmacies.

In a data security incident notice published on its website, Sunshine Health said that on May 6, it discovered that a caller impersonating a trusted individual had deceived an employee into disclosing a limited number of health plan files to an unauthorised party. The healthcare service provider immediately launched an investigation, with assistance from external cyber security experts, to determine the nature and scope of the incident.

It also took steps to secure the affected systems and notified relevant law enforcement authorities about the same.

The compromised data included names, dates of birth, medical information, history and health plan coverage information. In a filing with the U.S. Department of Health and Human Services, Sunshine Health said that it has identified at least 41,569 individuals impacted by the incident.

“Following this incident, we have implemented additional training for employees, and spread awareness around the ways unauthorised individuals may try to access our data or systems,” Sunshine Health said.

While Sunshine Health found no evidence of the compromised information being misused, it advised all affected individuals to regularly monitor their credit reports, account and benefit statements and report any suspicious activity to law enforcement authorities, including the police and the state attorney general.