Connecticut DSS HUSKY Medicaid provider account breach exposes 41,000; Gentlemen claims Hattiesburg Eye Clinic attack
The Connecticut Department of Social Services (DSS) reported that an unauthorized user accessed a HUSKY (Medicaid) provider reimbursement account, exposing protected health information of 41,000 individuals. Gainwell Technologies, the fiscal agent and account administrator, notified DSS on June 25, 2026. The investigation concluded the access was most likely financially motivated, though data theft could not be ruled out. The article also covers three smaller healthcare incidents: an attempted sale of CDPAP data by a former facilitator at Public Partnerships LLC (12,018 people), a network intrusion at Hattiesburg Eye Clinic claimed by The Gentlemen ransomware group (6,137 people), and unauthorized access at Eye Care Center of Snohomish (3,059 patients).
Detalhes técnicos
- Connecticut DSS/HUSKY: exposed data includes names, Medicare claim or provider payment account identifiers, dates of service, payment information, services received, amounts paid and non-Medicaid insurance information. EMRs, financial account information and SSNs were not involved. This is the second HUSKY incident this year; an earlier one in March 2026 affected about 22,500 people and used compromised credentials of a Hartford Healthcare employee.
- Public Partnerships LLC (NY CDPAP): a facilitator terminated in March 2026 tried to sell consumer data to another facilitator, who refused and reported it in June 2026. Data included names, addresses, dates of birth, Medicaid ID and PPL ID numbers and enrollment information. The sale appears not to have gone ahead.
- Hattiesburg Eye Clinic: network disruption on August 18, 2026; the review ended September 16, 2026. Data may include names, phone numbers, SSNs and diagnoses. The Gentlemen claimed the attack and says it stole data.
- Eye Care Center of Snohomish: unauthorized access identified August 12, 2026, dating to about July 28, 2026. Data may include names, addresses, birth dates, lab results, diagnoses, medications and treatment information.
Remediação
DSS secured the provider portal and offered credit monitoring and identity theft protection. Public Partnerships ordered the former facilitator to delete the data, reminded all facilitators that selling CDPAP data is unlawful, and notified HHS OCR and HHS OIG. Both eye care providers added technical safeguards; Hattiesburg Eye Clinic mailed notification letters to affected individuals, and Snohomish reported the incident to law enforcement.
Linha do tempo
-
Connecticut DSS HUSKY Medicaid provider account breach exposes 41,000; Gentlemen claims Hattiesburg Eye Clinic attack
ler a análise desta fonte ocultar
The Connecticut Department of Social Services (DSS) reported that an unauthorized user accessed a HUSKY (Medicaid) provider reimbursement account, exposing protected health information of 41,000 individuals. Gainwell Technologies, the fiscal agent and account administrator, notified DSS on June 25, 2026. The investigation concluded the access was most likely financially motivated, though data theft could not be ruled out. The article also covers three smaller healthcare incidents: an attempted sale of CDPAP data by a former facilitator at Public Partnerships LLC (12,018 people), a network intrusion at Hattiesburg Eye Clinic claimed by The Gentlemen ransomware group (6,137 people), and unauthorized access at Eye Care Center of Snohomish (3,059 patients).
Technical Details
- Connecticut DSS/HUSKY: exposed data includes names, Medicare claim or provider payment account identifiers, dates of service, payment information, services received, amounts paid and non-Medicaid insurance information. EMRs, financial account information and SSNs were not involved. This is the second HUSKY incident this year; an earlier one in March 2026 affected about 22,500 people and used compromised credentials of a Hartford Healthcare employee.
- Public Partnerships LLC (NY CDPAP): a facilitator terminated in March 2026 tried to sell consumer data to another facilitator, who refused and reported it in June 2026. Data included names, addresses, dates of birth, Medicaid ID and PPL ID numbers and enrollment information. The sale appears not to have gone ahead.
- Hattiesburg Eye Clinic: network disruption on August 18, 2026; the review ended September 16, 2026. Data may include names, phone numbers, SSNs and diagnoses. The Gentlemen claimed the attack and says it stole data.
- Eye Care Center of Snohomish: unauthorized access identified August 12, 2026, dating to about July 28, 2026. Data may include names, addresses, birth dates, lab results, diagnoses, medications and treatment information.
Remediation
DSS secured the provider portal and offered credit monitoring and identity theft protection. Public Partnerships ordered the former facilitator to delete the data, reminded all facilitators that selling CDPAP data is unlawful, and notified HHS OCR and HHS OIG. Both eye care providers added technical safeguards; Hattiesburg Eye Clinic mailed notification letters to affected individuals, and Snohomish reported the incident to law enforcement.