HMSA Data Breach Exposes Sensitive Personal and Health Information Health Management Systems of America (HMSA), a Detroit-based behavioral healthcare provider, disclosed a data breach stemming from a spear phishing attack that compromised a single employee email account. The incident was discovered on December 9, 2024, though HMSA only publicly acknowledged it in a Notice of Security Incident posted on November 11, 2025. The breach occurred when an unauthorized actor gained access to the email account, which contained sensitive personally identifiable information (PII) and protected health information (PHI). An IT security firm was engaged to investigate, and the U.S. Department of Health and Human Services was notified. While the full scope of exposed data remains under review, potentially compromised information includes: - Names - Addresses - Phone numbers - Social Security or Tax ID numbers - Medical records - Health insurance details HMSA is working with legal and data review teams to identify affected individuals, who will receive direct notification by mail. Those without current addresses will be notified via a substitute notice on HMSA’s website. The law firm Shamis & Gentile P.A. is investigating the breach, citing potential legal recourse for impacted individuals, including compensation for financial losses, time spent mitigating the breach, or emotional distress. The incident highlights ongoing risks in healthcare cybersecurity, particularly from targeted phishing attacks.