The California Office of the Attorney General disclosed a data breach affecting Health Net, occurring between March 4, 2021, and September 12, 2021. Unauthorized actors gained access to sensitive member information, including names, dates of birth, healthcare ID numbers, and clinical records. Approximately 1,000 individuals were impacted by the incident. The breach exposed personally identifiable information (PII) and protected health information (PHI), raising concerns over potential identity theft, fraud, or misuse of medical data. While the exact method of intrusion was not detailed, the prolonged duration of the breach (over six months) suggests a sustained vulnerability in Health Net’s systems. The incident underscores the critical need for robust cybersecurity measures in healthcare, where the exposure of such data can have severe repercussions for patient privacy and trust in the organization. No ransomware was reported in this case, and the focus remained on the unauthorized access and exfiltration of customer data.

The California Office of the Attorney General reported that Health Net Life Insurance Company experienced a data breach on January 7, 2021, involving unauthorized access to data files stored on Accellion’s system until January 25, 2021. The breach may have involved personal information such as names, addresses, dates of birth, insurance ID numbers, and health information potentially affecting an unknown number of individuals.

The California Office of the Attorney General reported a data breach involving Health Net of California on May 13, 2019. The breach occurred between March 1, 2019, and March 12, 2019, due to a coding error that resulted in protected health information (PHI) being sent to incorrect addresses, affecting an unspecified number of individuals.

The California Office of the Attorney General reported a data breach involving Health Net, Inc. on August 1, 2013. The breach was discovered on May 3, 2013, due to new member identification cards being mailed to incorrect addresses, affecting the personal information of CalViva Health Medi-Cal members. Specific information compromised included names, enrollment dates, and primary care physician details; however, the number of affected individuals was not disclosed.