Point32Health ransomware attack disrupted Harvard Pilgrim member services

Point32Health, the Massachusetts insurer formed by the merger of Harvard Pilgrim Health Care and Tufts Health Plan, identified a ransomware attack on 17 April 2023 and took multiple systems offline to contain it.

The outage hit systems supporting Harvard Pilgrim Health Care commercial plans and Medicare Advantage Stride plans, along with tools used to service members, accounts, brokers and providers. The HIPAA Journal reported that members experienced problems obtaining prior authorisations for medical procedures. Tufts Health Plan systems were not affected.

Point32Health said it took immediate action to contain the threat and was working with internal staff and third party cybersecurity specialists to investigate and restore service. No ransomware group publicly claimed the attack in the days after disclosure, and the insurer said at the time that it did not yet know whether protected health information had been exposed, committing to notify individuals if it had.

Later investigation established that attackers were inside Harvard Pilgrim systems from 28 March to 17 April 2023 and copied data during that window. Harvard Pilgrim, which serves more than 1.1 million members primarily in Massachusetts, New Hampshire, Maine and Connecticut, reported the breach to the HHS Office for Civil Rights in May 2023 as affecting 2,550,922 individuals. SecurityWeek reported in March 2024 that the confirmed total exceeded 2.86 million individuals, with exposed data including names, addresses, dates of birth, Social Security numbers, health insurance and financial account information, medical history, diagnoses and treatment information.