WebTPA data breach compromises information of over 2.4 million individuals

WebTPA, a provider of administrative services for health plans and insurers, experienced a significant data breach that exposed the personal information of more than 2.4 million individuals. The breach, which occurred between April 18 and April 23, 2023, was disclosed by the company recently, with details emerging from an undated website notice and notifications to affected parties.

The compromised data includes names, birth and death dates, Social Security numbers, contact details, and insurance information. Financial account information, credit card numbers, and medical treatment or diagnostic data were unaffected. WebTPA discovered suspicious activity on its network in late December 2023, leading to an investigation that confirmed the data exposure.

WebTPA President Lisa Tranberg emphasized the limited impact of the breach, stating that no misuse of the compromised information has been reported. Despite this, the company provides affected individuals with two years of credit monitoring, identity theft protection, and fraud consultation services through Kroll, available until August 1.

The breach has affected customers from several large insurance companies, including The Hartford, Transamerica, and Gerber Life Insurance. Notifications were sent to these insurance firms and benefit plans by late March, with individual notifications following in early May.

This incident adds to recent cyberattacks targeting healthcare-related entities, including Australian e-prescription service MediSecure, the Ascension health system, and Change Healthcare.

WebTPA, a GuideWell Mutual Holding Corporation subsidiary, employs 18,000 people and generates $103 million in annual revenue. As the company continues to address the aftermath of the breach, it advises affected individuals to remain vigilant for potential fraud attempts and to review their credit reports regularly. A security freeze on credit files is also recommended to prevent unauthorized access.