HMSA Data Breach Exposes Sensitive Health and Personal Information Hawaii Medical Service Association (HMSA) disclosed a data breach on December 9, 2024, after detecting unauthorized access to a single employee email account due to a spear phishing attack. The incident prompted an internal investigation, which confirmed that an unauthorized third party may have accessed and acquired sensitive personal identifiable information (PII) and protected health information (PHI) contained in the compromised emails. While HMSA has not publicly detailed the specific types of data exposed as of December 16, 2025, the breach notice indicates that affected individuals will receive a list of the impacted information. The organization has posted a breach notification on its website, though the full scope of the incident—including the number of individuals affected—remains unclear. The breach highlights ongoing risks posed by targeted phishing campaigns in the healthcare sector.

Hawai‘i Medical Service Association suffered a data breach incident in 2016 which exposed the personal information of 10,800 members. The privacy breach was caused because of an error made with the mailing of care management letters to members. The emails that were sent to incorrect individuals included information about members' specific health condition, Social Security numbers, or other sensitive personal information. HMSA immediately responded to the incident and asked the receiving party to delete the emails and notified the impacted persons of the breach.