HealthEquity suffered a data breach affecting over four million individuals. Compromised data includes names, addresses, phone numbers, employee IDs, employer information, social security numbers, dependent information, and payment card details. Although not all records contained complete data sets, the breach's scale is considerable given HealthEquity's customer base of over 15 million accounts. The company has taken measures to enhance security and prevent future incidents, alongside offering identity theft protection services to the impacted customers.

The California Attorney General reported a data breach involving HealthEquity, Inc. on May 16, 2025. The breach occurred on March 9, 2024, and involved unauthorized access to personally identifiable information, including names, addresses, and social security numbers, affecting an unknown number of individuals.

The Washington State Office of the Attorney General reported a data breach involving HealthEquity Inc. on November 15, 2018. The breach, which occurred between September 4, 2018, and October 5, 2018, was caused by a cyberattack (phishing) and affected approximately 27,175 individuals, potentially exposing names, Social Security Numbers, and other information.

HealthEquity has notified individuals potentially impacted by a security incident. A single employee’s email account was accessed by an unauthorized individual that has culminated in the disclosure of protected health information. As soon as HealthEquity discovered the incident, the unauthorized individual’s access to the mailbox was eliminated and an investigation was initiated to determine the nature and scope of the event. HealthEquity confirmed that only one email account belonging to a single HealthEquity employee was compromised as a result of human error. No other HealthEquity systems were impacted or affected. The email account contained protected health information including names, emails, HealthEquity member IDs, employer names, HealthEquity employer IDs, and healthcare account type, deduction amounts, and Social Security numbers for some Michigan-based employees.

The California Office of the Attorney General reported a data breach involving HealthEquity on January 25, 2016. The breach occurred on December 11, 2015, due to an employee inadvertently sending an email that included personal information, specifically names and Social Security numbers. This incident highlights the risks associated with human error in handling sensitive data, as it resulted in the unauthorized disclosure of personal information.