Disability Rights Wisconsin email breach exposed 19,150 Medicaid members

The Wisconsin Department of Health Services announced on Friday 21 June 2024 that Disability Rights Wisconsin, a partner advocacy organisation that helps residents with disabilities access services, had suffered a security incident. The department said the incident may have exposed protected health information belonging to 19,150 people enrolled in Wisconsin Medicaid.

The intrusion came to light through suspicious activity on a Disability Rights Wisconsin employee email account. An unauthorised third party had obtained access to the mailbox. Disability Rights Wisconsin identified the suspicious activity on 22 November 2023, about seven months before the June 2024 notifications, and placed the unauthorised access in or around October 2023. Its notification listed the information potentially involved as names, treatment and diagnosis information, provider names, Social Security numbers, health insurance identification numbers, financial account information and dates of birth.

Disability Rights Wisconsin mailed notification letters to affected Medicaid members on 21 June. Those notified were offered one year of credit monitoring at no cost and given a dedicated telephone line, 888-733-3814, which began taking calls on Monday 24 June and operated on weekdays between 8am and 8pm central time.

The department said it was investigating jointly with Disability Rights Wisconsin and would address any further problems the review turned up. As of the reporting date no evidence had been published showing the exposed information had been misused.