Claim: Unauthorized access exposes data of 41,000 Connecticut Medicaid recipients
Connecticut's Department of Social Services reported unauthorized access to a Medicaid (HUSKY) provider reimbursement account, exposing protected health, claims and payment information of 41,000 people. Fiscal agent Gainwell Technologies reported the breach on June 25, and the access appears financially motivated. Recipients should watch for notices and monitor their data.
What happened
An unauthorized user gained access to a Connecticut Medicaid (HUSKY) provider reimbursement account. The Department of Social Services was informed by Gainwell Technologies, the account's fiscal agent and administrator, on June 25, 2026. Data on 41,000 beneficiaries was exposed.
Why it matters
The breach involved names, identification numbers, dates of service, amounts paid, and non-Medicaid health insurance information. Electronic medical records, financial information, and Social Security numbers were not involved. The investigation points to financial motivation, but data theft could not be ruled out, leaving fraud risk with the exposed data.
What to do
The provider portal has been secured. Beneficiaries should await the official notification and enroll in the complimentary credit monitoring and identity theft protection services offered by the state.
For the technical team
- Affected
- Connecticut Department of Social Services Conta de reembolso de provedores do Medicaid de Connecticut (programa HUSKY), administrada pela Gainwell Technologies · Connecticut Medicaid HUSKY provider reimbursement account; data on 41,000 beneficiaries.
- Exploitation
- Access confirmed by the Connecticut Department of Social Services itself and under investigation; most likely financially motivated, though data theft could not be ruled out. Portal has been secured.
- Fix
- No software fix applicable; the provider portal has been secured and affected individuals were offered credit monitoring and identity theft protection.
- Vector
- Unauthorized access to a Connecticut Medicaid (HUSKY) provider reimbursement account on the provider portal administered by Gainwell Technologies; the intrusion method was not disclosed.
- More details
- The breach was reported to DSS by Gainwell Technologies on June 25, 2026. Exposed data: names, identification numbers associated with Medicare claims or provider payment accounts, dates of service, payment information, services received, amounts paid, and non-Medicaid health insurance information. Electronic medical records, financial information, and Social Security numbers were not involved. According to HIPAA Journal, this is the second such incident announced this year.
Timeline
Breach notice published: 41,000 HUSKY Medicaid recipients affected.
