WebTPA webtpa.com WebTPA data breach: what happened and what to do
WebTPA, a health plan administrator, reported to HHS in May 2024 that 2,429,175 people were affected. An intruder may have had access in April 2023. Exposed: names, contact details, dates of birth, insurance details and Social Security numbers.
View all 13,115 breaches- Breach date
- 18 Apr 2023
- Made public
- 8 May 2024
- Affected
- 2,429,175
- Data exposed
- Names, Dates of birth, Social security numbers, Health insurance information
- Last updated
What happened
WebTPA is a Texas company that administers health benefit plans for employers and insurers, and a subsidiary of GuideWell. In December 2023 it learned that an unauthorized party may have reached some of its systems. Its investigation found the intruder may have obtained personal information between April 18 and April 23, 2023. Notices began going out in April 2024.
WebTPA reported the breach to the U.S. Department of Health and Human Services (HHS) on May 8, 2024, listing 2,429,175 people. A state attorney general notification covers only one state's residents (38,420 people in Washington), so that figure is a fraction of the total. Coverage of the incident hasn't reported how the intruder got in.
What was exposed
According to coverage of the notice, the data included names, contact details, dates of birth and death, health insurance information and Social Security numbers. WebTPA said financial and health data were not affected. Which items were involved varies by person, and the number of Social Security numbers taken hasn't been disclosed.
What that lets criminals do
Social Security numbers with names and dates of birth are enough to apply for credit or loans in someone's name. Death dates matter too: they can be used to attack the identities of relatives or to file fraudulent claims. Because WebTPA works on behalf of employers and plans, many people never dealt with it directly and didn't know their data was there.
Contact details and plan information feed phishing. A message that mentions your health plan and looks like a benefits update is a common pattern after breaches like this.
Why you may not have heard of WebTPA
A third-party administrator sits between your employer or insurer and the claims. It processes claims, checks eligibility and holds member records. You never sign up with it, which is why a notice from a company you don't recognize can be confusing, and why some people mistake it for a scam. If a WebTPA letter reaches you, check it against your plan's own website or the number on your insurance card before acting on it.
The timing is also long. The intruder was in the systems in April 2023, WebTPA found out in December 2023, and notices started in April 2024. That is a year between the intrusion and the first letters, so assume your data has had time to circulate.
The company's response
WebTPA said it isn't aware of misuse of plan member information as a result of the incident. It offered two years of identity monitoring through Kroll, according to reporting. At least seven class action lawsuits were reported.
What to do
Freeze your credit if your letter says your Social Security number was involved: the freeze is free and blocks new accounts. Use the monitoring offer, and review your benefits statements. Serus monitors breach databases and the dark web for your email, phone and other details and alerts you when they show up in a new leak. It can't remove data from a breach, so the steps below are the practical protection.
What to do if you were in it
- 1
Freeze your credit at all three bureaus
A free freeze at Equifax, Experian and TransUnion blocks new accounts opened with your Social Security number.
- 2
Use the identity monitoring offer
WebTPA offered two years of monitoring through Kroll. Enroll with the code in your letter.
- 3
Review your benefits statements
Look for claims you don't recognize and report them to your plan.
- 4
Expect phishing that mentions your plan
Don't click links in messages about benefits or the breach. Contact your plan using the number on your card.
- 5
Check whether your email or phone is in this and other breaches
Run a free Serus scan to see where else your details have leaked.
Frequently asked
Was I affected by the WebTPA breach?
WebTPA mailed notices to affected people. If you got a letter, your data was involved. If you're unsure, ask your health plan or employer whether WebTPA administers your benefits.
How many people were affected?
HHS lists 2,429,175 people. State filings cover only residents of one state, so they show smaller numbers.
Were Social Security numbers exposed?
Coverage of the notice says Social Security numbers were among the data, for some people. WebTPA said financial and health data weren't affected.
Is there a lawsuit?
At least seven class action lawsuits were reported. Check the notice and the court filings for how to take part.
Sources
Something wrong or out of date? Tell us and we'll re-check it.
