BlogNews4TH JUL 2024
AuthorSamir Yawar
3 min read
News

HealthEquity Breach: Healthcare fintech suffers partner account compromise

Twitter
Facebook
WhatsApp
Email
LinkedIn
blog image about Healthequity data breach

Healthcare fintech firm HealthEquity has announced a data breach resulting from a compromised partner account, which allowed unauthorized access to the company's systems and led to the theft of protected health information.

Healthequity logo


How did the HealthEquity breach happen?

The HealthEquity breach was detected after observing unusual activity from a partner's device, prompting an immediate investigation. The investigation revealed that hackers had compromised the partner's account, leveraging it to gain unauthorized access and exfiltrate sensitive health data.

According to the company's SEC filing:

The investigation concluded that the partner's user account had been compromised by an unauthorized third party, who used that account to access information. The accessed information included some personally identifiable information, which in some cases is considered protected health information, pertaining to certain of our members."

Furthermore, the investigation indicated that some of this information was subsequently transferred off the partner's systems.

Who is affected by HealthEquity data breach?

HealthEquity, a major provider of health savings accounts (HSAs) and other consumer-directed benefits solutions such as flexible spending accounts (FSAs), health reimbursement arrangements (HRAs), and 401(k) retirement plans, is one of the largest HSA custodians in the United States. The firm manages millions of HSA, FSA, HRA, and other benefit accounts, collaborating with numerous employers and health plans.

While the exact impact and number of individuals affected by the security incident remain undisclosed, HealthEquity has begun notifying those impacted. The company is also offering complimentary credit monitoring and identity restoration services to mitigate potential risks.

HealthEquity's internal investigation has not found evidence of malware on its systems, and no technical interruptions have occurred. All business operations and services continue to function normally.

The company is currently assessing the incident's impact and response costs but does not anticipate any material effect on its business or financial results.

Samir Yawar
Samir Yawar / Content Lead
Samir wants a world where people can instinctively whack online scams and feel accomplished without the need for psychic powers. As an ISC2 member, he is doing his bit to turn cybersecurity awareness training into a fun concept with simple, approachable and accessible content. Reach out to him at X @yawarsamir
FAQsFrequently Asked Questions
Inherent risk can vary significantly based on industry, size, and the nature of an organization's operations. Industries dealing with sensitive data, like finance or healthcare, may face different inherent risks compared to smaller organizations with less complex IT infrastructures.