Health Net healthnet.com Health Net data breach: what happened and what to do
In January 2021, attackers compromised Accellion, a file transfer service Health Net used. Health Net's notices say members' names, addresses, dates of birth, insurance ID numbers and health information may have been involved, and for some members Social Security numbers too.
View all 13,177 breaches- Breach date
- 7 Jan 2021
- Data exposed
- Names, Physical addresses, Dates of birth, Health insurance information, Medical information, Social security numbers
- Last updated
Reviewed by Anthon Wansland
Head of Product & Co-Founder
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
What happened
Health Net used a file transfer product from a vendor called Accellion to swap data files with doctors and other companies that support its operations. On January 25, 2021, Accellion told Health Net that an unknown party had compromised that platform. The filing Health Net made with the California Attorney General lists the exposure window as January 7 to January 25, 2021.
The Accellion platform was the weak point, not Health Net's own member systems. Several Health Net entities filed notices, including Health Net of California and Health Net Community Solutions.
Sources checked: oag.ca.gov, healthnet.com, healthnetoregon.com
Last verified against the official page:
What was exposed
The California filing says names, addresses, dates of birth, insurance ID numbers and health information may have been involved. Health Net's Oregon update says some members had their information exposed without Social Security numbers, and others had their Social Security numbers exposed too. Which items applied to you depends on your letter.
What that means for you
A name, address and date of birth together are enough for phishing that looks personal, and with a Social Security number they can be used to open accounts in your name. An insurance ID number can be misused to bill for care you never got, so your insurer's statements are worth reading.
The company's response
Health Net says it stopped using Accellion's services and removed its data files from that system.
What to do if you were in it
- 1
Read your notice letter
Health Net mailed letters to affected members. It tells you which of your details were involved, so you know which of the steps below apply.
- 2
Freeze your credit if your Social Security number was involved
The FTC says a credit freeze is free and you place it separately at Equifax, Experian and TransUnion.
- 3
Read your explanation of benefits statements
Look for treatment or claims you don't recognize, and call your insurer if you find one. The FTC's guidance on medical identity theft covers what to do next.
- 4
Expect phishing that mentions the breach
Don't click links or give details to anyone who contacts you about it. Go to Health Net's website yourself if you want to check something.
- 5
Check whether your email or phone is in this and other breaches
Serus monitors breach databases and the dark web and alerts you when your details show up. A free scan shows where you stand today.
Official filings
- California Attorney General , filed 22 Dec 2021
Timeline
-
The breach happened
-
Reported to the California Attorney General
Frequently asked
Was I affected by the Health Net breach?
Health Net sent letters to the members it identified as affected. If you didn't get one, you can contact Health Net member services to ask.
What was exposed in the Health Net breach?
Names, addresses, dates of birth, insurance ID numbers and health information may have been involved. For some members, Social Security numbers were too.
Was Health Net hacked directly?
No. The attack hit Accellion, a vendor whose file transfer platform Health Net used. Health Net says it has stopped using it.
Should I freeze my credit?
If your letter says your Social Security number was involved, yes. The FTC says a freeze is free and you place it at each of the three bureaus.
Sources
- oag.ca.gov/system/files/Health%20Net%20of%20California%20-%20Accellion%20Breach%20Notice%20Letter.pdf
- healthnet.com/content/dam/centene/healthnet/pdfs/member/ca/health-net-member-notice-letter-210324.pdf
- healthnetoregon.com/newsroom/accellion-data-breach-oregon-update.html
- consumer.ftc.gov/articles/what-know-about-credit-freezes-and-fraud-alerts
- consumer.ftc.gov/articles/medical-identity-theft
Something wrong or out of date? Tell us and we'll re-check it.
