Cigna cigna.com Cigna data breach: what happened and what to do
In 2019, Cigna reported that fraudulent accounts on a partner's provider portal exposed the names, dates of birth, addresses and health insurance information of 3,720 people, according to HHS.
View all 13,177 breaches- Breach date
- 16 May 2019
- Made public
- 16 May 2019
- Affected
- 3,720
- Data exposed
- Names, Dates of birth, Physical addresses, Health insurance information
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
In May 2019, Cigna reported to the U.S. Department of Health and Human Services (HHS) a breach that affected 3,720 people. HHS's public breach portal lists it as a hacking or IT incident.
According to HHS's summary, the problem started at Availity, a business associate (a company that handles health data on a health plan's behalf). Fraudulent provider accounts were set up on Availity's provider portal. Cigna notified HHS, the affected individuals and the media.
What was exposed
HHS lists names, dates of birth, addresses and health insurance information. Together, that is enough for someone to pose as you with an insurer or a provider, or to write a convincing letter or call that already knows your plan details.
The company's response
Cigna offered two years of complimentary identity protection services to the people affected.
What this means for you
If you got a notice letter, it is real and worth keeping. If you didn't get one, you are very likely not one of the 3,720 people involved. Be wary of anyone who contacts you about this breach and asks for payment or account details. Use the contact details printed on your insurance card, not the ones in a message.
Sources checked: ocrportal.hhs.gov, consumer.ftc.gov, identitytheft.gov
Last verified against the official page:
What to do if you were in it
- 1
Read your notice and watch your insurance statements
Review explanations of benefits for services you didn't receive, and use the identity protection Cigna offered if you got a letter.
- 2
Freeze your credit if your identity details were involved
A credit freeze at Equifax, Experian and TransUnion is free and stops new accounts being opened in your name. The FTC explains how to place one.
- 3
Report misuse at IdentityTheft.gov
If you see accounts or charges you don't recognize, the FTC's IdentityTheft.gov builds a recovery plan and walks you through reporting it.
- 4
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see where your details have turned up, and get alerts if they appear in new breaches.
Official filings
- U.S. Department of Health and Human Services , filed 16 May 2019 : 3,720 people
- U.S. Department of Health and Human Services , filed 10 Oct 2018 : 3,500 people
Timeline
-
Reported to U.S. Department of Health and Human Services
-
The breach happened
-
The company made it public
-
Reported to U.S. Department of Health and Human Services
Frequently asked
Was I affected by the Cigna data breach?
HHS lists 3,720 people. Affected people were sent a notice letter by Cigna.
What was exposed?
Names, dates of birth, addresses and health insurance information, per HHS.
Did Cigna offer anything to affected people?
Yes, two years of complimentary identity protection services, according to HHS.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
