Missing Health Net Disk Might Have Been Stolen: AG

Six months ago, Health Net lost a portable disk drive that contained personal information of hundreds of thousands of patients, including John Adams, of Windham Center, but he said he did not learn about it until watching NBC Connecticut news.

It is because of patients like Adams that Attorney General Richard Blumenthal took on the issue.

Last month, he said he was investigating because the disc had been missing for six months before authorities learned of the breach.

On Monday, he said the investigation has grown because the disc that contained health information, social security number and bank account numbers for 446,000 patients from Connecticut might have been stolen, not just misplaced. 

When Adams learned of the breach, he called Health Net only to find out that he, his wife and daughter were victims too.

"There could be personal medical information about me or my daughter that's out there, or my wife, and anybody could have access to it," says Adams. "It's just very, very upsetting."

The disk went missing in May but authorities were not told until November, an issue that inflamed Blumenthal last month.

Adams said what makes him even more angry is that they could have been notified about the security breach six months ago.

"I never got any notification from Health Net, never got anything in the mail. Today's Dec. 7," said Adams.

Now Blumenthal wants more details about the security breach and two laptops that were also apparently stolen from Health Net’s Shelton office. He is also asking federal criminal authorities to investigate the potential theft that he says could have national ramifications.

Health Net officials said they were not able to determine which information was on the disk, so they investigated and learned the information was saved in an image format that cannot be read without special software, but it contained personal information for many past and present Health Net members. 

Blumenthal said that is inconsistent with what a security company says in a recent report.

“An independent investigative report shreds Health Net’s sanitized story -- revealing that this severe security breach was most likely a theft, and that two laptops were also stolen from Health Net’s facility at virtually the same time,” Blumenthal said. “This report dramatizes Health Net’s unconscionable delay in notifying law enforcement and its customers about this breach.”

Blumenthal said the likelihood that the drive was stolen should have raised alarms that sensitive information could be exploited for criminal purposes, and prompted a rapid response and timely disclosures both to affected members and law enforcement.

Health Net hired Kroll, a security company, to assess the loss of the missing disk drive and Blumenthal said there are inconsistencies between what Health Net reports and the Kroll report, which says the data could be easily accessed through common commercially available software.

The Kroll report, Blumenthal said, indicates another Health Net office in Rancho Cordova might have had a copy of the compromised information on hand to identify.

“Health Net has gone out of its way to dismiss and downplay this serious security breach when it should have been focusing on notifying and protecting people who may be at risk of financial fraud or having health information leaked.”

Now, Blumenthal wants a meeting with Health Net staff and answers to even more questions.

Health Net told Adams that they would provide him with free protection for two years, meaning they will call him whenever there is a change in his credit. Adams says he still wonders how this will all affect his family long term.

"What about my daughter, who's 6?" asked Adams. "This could follow her down the road for a long, long time."

Contact Us