Kannact says March data breach impacted more than 117,000 individuals

Albany, Oregon-based healthcare services provider Kannact said a data breach it suffered in March compromised the sensitive personal information of more than 117,000 individuals.

In a recent data breach notice filed with the Office of the Maine Attorney General, Kannact said that on 13th March, it identified unauthorised access to its internal network and immediately launched an investigation with assistance from third-party cyber security experts to understand the nature and scope of the incident.

A preliminary investigation revealed that the sensitive personal information of Kannact’s customers was affected during the data breach. The compromised information included names, dates of birth, addresses, phone numbers, social security numbers, driver’s license numbers, and protected health information such as medical diagnoses, treatment, pharmaceutical records, and Kannact IDs.

The company said that not all individuals had their social security numbers and driver’s license numbers impacted.

While Kannact did not specify the number of affected individuals in its data breach notice, a filing with the U.S Department of Health and Human Services Office for Civil Rights Breach Portal states that at least 103,547 individuals were affected in the security incident. However, in a separate filing with the Office of the Maine Attorney General, Kannact revised the number of affected individuals, stating that at least 117,968 individuals were affected by the incident.

“On June 13, 2023 the forensic investigation concluded and found evidence that suggested an unauthorised individual compromised sensitive data from one of Kannact’s third party file transfer solutions. There was no other unauthorised activity in Kannact’s environment and no evidence of any compromised sensitive personal information from any other systems in Kannact’s environment.

“In sum, the scope of the incident was limited in nature, arising from a software vulnerability in Kannact’s third party file transfer solution,” the company said in its data breach notice.

Kannact is in the process of notifying all affected individuals about the data security incident and has agreed to provide a year of complimentary credit monitoring and identity theft protection services to all the impacted individuals.

“Kannact encourages all members to remain vigilant against incidents of identity theft and fraud, to review account statements, and to monitor credit reports for suspicious or unauthorised activity.

“Additionally, security experts suggest that individuals contact his/her financial institution and all major credit bureaus to inform them of such a breach and take the recommended steps to protect his/her interests, including the possible placement of a fraud alert on the credit file,” Kannact added.