Healthcare Breaches at Clover Health and AngMar Affect More Than 250,000 People
Summary
Separate breaches at Clover Health and AngMar Management Services exposed personal and health information. Clover reported 138,677 affected people; AngMar reported 126,196.
Key points
- Attackers used social engineering to compromise three non-managerial Clover Health employee accounts in early July.
- Clover said the stolen data could include names, birth dates, insurance identifiers, and account identification numbers.
- AngMar detected suspicious system activity in mid-July and confirmed in early September that hackers had stolen patient personal and health information.
- AngMar's affected data included Social Security numbers, diagnoses, medical histories, insurance details, prescription information, and dates of service.
- The Interlock ransomware group claimed it stole more than 700 GB from AngMar and listed the company on its leak site.
- Clover reported 138,677 affected people to HHS; AngMar reported 126,196.
Article Details
- Victim Organization
- Clover Health Investments; AngMar Management Services
- Incident Type
- Separate data breaches involving social engineering and compromise of three Clover Health employee accounts, and unauthorized access to AngMar Management Services systems.
- Data Types Exposed
- Personally identifiable information (PII)
- Protected health information (PHI)
- Names
- Dates of birth
- Insurance identifiers
- Account identification numbers
- Social Security numbers
- Diagnosis details
- Medical history data
- Health insurance information
- Patient IDs
- Provider names
- Prescription details
- Dates of service
- Affected Records
- Clover Health reported 138,677 affected people to HHS; AngMar reported 126,196. Combined: 264,873 people.
- Affected Data Size
- Interlock claimed to have stolen over 700 gigabytes of data from AngMar; this volume was not confirmed in the article.
- Operational Impact
- The article reports information theft from both organizations but does not describe operational disruption.
- Ransom Or Extortion
- Interlock listed AngMar on its Tor-based leak site and claimed to have stolen over 700 gigabytes of data. The article does not report a ransom demand or independently confirm the claimed volume.
- Claim Status
- confirmed