Connexin Software experienced a breach that affected 2,216,365 patients. An unauthorized individual accessed an offline set of patient data used for data conversion and troubleshooting. The exposed patient information included: (1) patient demographic information (such as patient name, guarantor name, parent/guardian name, address, email address, and date of birth); (2) Social Security Numbers (“SSNs”), (3) health insurance information (payer name, payer contract dates, policy information including type and deductible amount and subscriber number); (4) medical and/or treatment information (dates of service, location, services requested or procedures performed, diagnosis, prescription information, physician names, and Medical Record Numbers); and (5) billing and/or claims information (invoices, submitted claims and appeals, and patient account identifiers used by your provider). The company notified the impacted individuals about the breach.

The Vermont Office of the Attorney General disclosed a data breach affecting Connexin Software, Inc. on November 28, 2022, stemming from an incident on August 26, 2022. Unauthorized actors gained access to an offline set of patient data, compromising sensitive information such as demographic details, Social Security Numbers (SSNs), health insurance records, medical data, and billing information. The exact number of impacted individuals remains undetermined, but the exposure of SSNs and medical data poses severe risks, including identity theft, financial fraud, and potential misuse of health-related information. The breach highlights vulnerabilities in securing offline data repositories, raising concerns over the company’s data protection measures and the long-term consequences for affected patients, who may face prolonged monitoring for fraudulent activity or unauthorized use of their personal and health records.

The California Office of the Attorney General disclosed a data breach affecting Connexin Software, Inc. on November 14, 2022, stemming from an incident on July 17, 2022. Unauthorized actors gained access to an offline set of patient data, potentially exposing highly sensitive personal information. The compromised data included names, Social Security Numbers (SSNs), health insurance details, and medical records—critical identifiers that heighten risks of identity theft, financial fraud, and medical fraud. The breach underscores vulnerabilities in securing offline or archived datasets, which are often perceived as lower-risk targets. Given the nature of the exposed data (SSNs and medical records), affected individuals face long-term repercussions, including fraudulent credit applications, unauthorized medical services, and targeted phishing attacks. The incident also raises concerns about compliance with healthcare data protection regulations (e.g., HIPAA), as the exposure of protected health information (PHI) could trigger regulatory penalties and erode patient trust. While the attack vector (e.g., insider threat, external hacking) was not specified, the unauthorized access to offline records suggests either physical security lapses or compromised backup systems. The breach’s delayed disclosure (nearly 4 months) may further amplify reputational damage and legal scrutiny.