United HealthCare reports data breach that may have revealed customers' personal information
United HealthCare made customers aware of a data breach on Friday, which temporarily allowed access to personal information for those enrolled in the company's healthcare plans.
According to a statement, "suspicious activity" was noticed on the UHC mobile application "that may have led to the disclosure of member information."
The company says that the breach happened between February 19 and February 25, and it was determined on April 10 that some member information was impacted.
They believe that information including members' first and last names, health insurance member identification numbers, dates of birth, addresses, dates of service, provider names, claim information and group name and number may have been available.
"This incident did not involve the disclosure of Social Security numbers or driver's license numbers," the statement said.
Members who had their information impacted were contacted directly by UHS via mail starting Friday.
"Upon discovery, the company took prompt action to investigate the matter. The portal account for members was locked to prevent any further access and we initiated a forced password reset," the statement noted. "Through our investigation we determined that the application was the target of a credential stuffing attack. We have no evidence that member login credentials used during the attack were accessed or obtained from any UnitedHealthcare system."
UHS is offering two years of free theft protection services to members as a precaution.
"The company regrets this incident and any inconvenience or concern it may cause," the statement said.
Anyone with further questions on the breach is asked to contact UHS at (800) 669-1812.
