HealthEquity healthequity.com HealthEquity data breach: what happened and what to do
HealthEquity, a health savings account provider, said an attacker used a business partner's credentials from March 2024 to reach data on about 4.3 million people, including Social Security numbers, and for some people diagnosis and prescription details.
View all 13,115 breaches- Breach date
- 9 Mar 2024
- Affected
- 4,300,000
- Data exposed
- Names, Physical addresses, Phone numbers, Social security numbers, Payment card information, Medical information
- Last updated
HealthEquity, which administers health savings accounts, disclosed in July 2024 that an attacker had reached an outside data store holding information on about 4.3 million people. The company reported the incident in an SEC Form 8-K filed on July 2, 2024.
What happened
The attacker got in by using the credentials of one of HealthEquity's business partners, according to the company. Reports date the compromise to March 9, 2024. Those credentials gave access to what HealthEquity called an unstructured data repository outside its core network. The company said no malware was placed and its services were not disrupted. Sources differ on when HealthEquity first noticed the activity, with some reports saying late March and others late June.
What was exposed
Reported categories include names, addresses, phone numbers, employer and employee IDs, Social Security numbers, dependent information and payment card information (not card numbers). For some people the data also included diagnoses and prescriptions. Not every category was exposed for every person.
That mix matters. Social Security numbers, names and addresses are what identity thieves need to open credit in your name. Health details make phishing more convincing, because a message that mentions a real prescription or insurer looks legitimate.
The company's response
HealthEquity offered affected people two years of credit monitoring, identity theft insurance and restoration services through Equifax.
What to do if you were in it
- 1
Freeze your credit
Place a free credit freeze at Equifax, Experian and TransUnion so nobody can open new credit in your name. Then check your reports at annualcreditreport.com. The FTC explains how freezes work.
- 2
Take the free credit monitoring if it's offered
HealthEquity offered two years of monitoring through Equifax. Use the code in your notice letter. It alerts you to new credit activity but doesn't stop it, so pair it with a freeze.
- 3
Watch your statements and explanations of benefits
Read the explanations of benefits your insurer sends and your HSA statements. Question any treatment or claim you don't recognize.
- 4
Expect scams that mention the breach
Emails, texts and calls that quote real details about you, or offer help with the breach, are a common follow-up. Don't click links in them. Go to the company's own site or phone number instead.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan. Serus monitors breach databases and the dark web for your details and alerts you when they show up in a new leak.
Frequently asked
Was I affected by the HealthEquity breach?
HealthEquity notified affected people by letter. If you have or had a health savings account administered by HealthEquity, or are listed as a dependent on one, look for that notice.
What was exposed in the HealthEquity breach?
Reports list names, addresses, phone numbers, employer and employee IDs, Social Security numbers, dependent information and payment card information, and for some people diagnoses and prescriptions.
How did the attacker get in?
By using the credentials of a business partner, according to HealthEquity. The company said it found no malware and no disruption to its systems.
Should I freeze my credit?
If your Social Security number was exposed, yes. A freeze is free and you place it at each of the three credit bureaus.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
