◆ A&A Services—doing business as pharmacy benefit manager Sav-Rx—experienced a security incident that resulted in a breach affecting more than 2.8 million patients. According to the company’s FAQs and information on the breach, the Nebraska-based company identified “an interruption to our computer network” on Oct. 8. “As a result of the investigation, we learned that an unauthorized third party was able to access certain non-clinical systems and obtain certain files that contained personal information,” Sav-Rx said. “However, in conjunction with third-party experts, we have confirmed that any data acquired from our IT system was destroyed and not further disseminated.” The company said it was providing credit monitoring services for those whose data might have been impacted. It also said that it has taken steps to enhance its security protocols and controls, technology, policies and training and will continue to assess further options to protect its IT systems.[1]
◆ A data breach at third-party administrator WebTPA Employer Services has impacted nearly 2.5 million people. WebTPA—a GuideWell Mutual Holding Company subsidiary—has customers that include The Hartford, Transamerica and Gerber Life Insurance. The company said in its “Notice of Data Security Incident” that it detected suspicious activity on its network Dec. 28 and launched an investigation. “The investigation concluded that the unauthorized actor may have obtained personal information between April 18 and April 23, 2023,” WebTPA said. The impacted information may have included names, contact information, dates of birth, dates of death, Social Security numbers and insurance information. Not every data element was present for every individual, and financial information, such as financial account and credit card information and treatment or diagnostic information were not impacted, the company said. WebTPA is offering affected individuals two years of complimentary identity monitoring services. According to the HHS Office for Civil Rights Breach Portal, 2,518,533 people were impacted by the breach.[2]
