Texas Investigates Insider Breach, Theft of Benefit Funds

Authorities in Texas are investigating an insider incident at the Texas Health and Human Services Commission that led to the firing of seven employees, an investigation into hundreds of thousands of dollars in stolen funds and notification of a breach of personal information affecting 61,000 people.

See Also: Using the Netskope HIPAA Mapping Guide

The Texas commission, which administers health and human services benefit programs including Medicaid and Supplemental Nutrition Assistance Program, said that on Nov. 21, 2024, the agency “learned the account information and personal identifying information of at least 61,000 individuals may have been improperly accessed by agency employees.”

HHSC said it took “immediate steps to mitigate the breach by terminating the employees involved and referring the incident to the Texas Health and Human Services Office of Inspector General for investigation and coordination with prosecutor offices to pursue criminal charges.”

The data, which may have been inappropriately accessed between June 2021 and December 2024, varies among individuals, but potentially includes full names, home addresses, telephone numbers, dates of birth, email addresses, Social Security numbers, Medicaid and Medicare Identification numbers, financial, employment, banking, benefits, health, insurance, medical, certificate, license and other personal information.

“Some Lone Star Cards containing SNAP funds may have been improperly accessed or used,” HHSC said in a frequently asked questions document about the breach.

“HHSC advises SNAP recipients to check their Lone Star Card transactions for potential fraudulent activity at YourTexasBenefits.com or through the Your Texas Benefits mobile app,” the agency said.

Local media outlet Texas Tribune reports that so far a total of seven workers were fired and that the improper access breach pertained to four separate incidents, including one involving the theft of $270,000 from 500 SNAP accounts.

The agency said it is still trying to determine whether other HHSC programs were affected. “As the agency’s internal review continues, additional affected individuals identified will be notified. Employees involved in similar inappropriate and illegal conduct will be terminated and referred to the appropriate authorities,” HHSC said.

HHSC did not immediately respond to Information Security Media Group’s request for additional details about the incident, including the number of employees implicated in the breach.

Taking Action

HHSC said it is offering affected individuals two years of complimentary identity and credit monitoring. Also, HHSC said it is “strengthening internal security controls” and implementing additional fraud prevention measures, including enhanced monitoring and alerts to detect suspicious activity.

Some experts question why it took HHSC so long to detect the improper access by the state employees.

“The fact that threat actors were in the network for so long – far longer than the average of 200-plus days to detect a compromise – suggests that the state does not use comprehensive monitoring to alert on aberrational behavior,” said Mike Hamilton, field CISO at security firm Lumifi. It is also possible that the threat actors used undetectable tools, techniques and procedures, he said. “It’s likely they used living off the land tactics, such that activity seemed ‘normal,” he said.

Hamilton suspects that HHSC likely learned of the incident first through reports of fraud from SNAP benefit recipients, which would have initiated an internal investigation.

“Databases would have logged accesses that were likely acquired through gaining legitimate user credentials, but which did not align with ‘normal’ operations – for example by time of day, amount of data accessed, or an exfiltration event showing a burst of data leaving the network,” he said.

“Without a system to aggregate this information, it would have taken quite a while to identify, obtain and examine all the data necessary to identify the cause of the fraud.”

To combat insider threats, security organizations should take steps to prevent improper access to off-limits data by authorized users in their organizations, experts advised.

Andrew Mahler, vice president of privacy and compliance services at consulting firm Clearwater, recommends healthcare organizations use role-based access controls to ensure users can only access the least amount of data necessary to perform specific job functions.

“These controls can be role or responsibility-specific. Using RBAC isn’t a set-it-and-forget-it exercise. It should be an ongoing process with routine reviews and adjustments, especially when employees change roles or leave your organization,” he said.

“It’s also important to conduct routine internal and third-party audits and assessments to ensure you’re effectively testing and documenting controls.”

Attractive Targets

The revelation of the Texas HHSC breach comes on the heels of a recent incident in Rhode Island also affecting the personal information of beneficiaries of state programs including SNAP and Medicaid. Except in that Rhode Island case, the data of potentially hundreds of thousands of people was stolen by cybercriminals that hacked RIBridges, the Rhode Island benefits IT system managed by consulting firm Deloitte (see: Thousands Affected by Data Theft Hack at Smallest U.S. State).

“State government health-related IT systems are attractive targets for unauthorized access and cyberattacks for several reasons,” said former healthcare CIO David Finn, principal of consulting firm Cyber Health Integrity LLC.

“First, these systems store vast amounts of personal and sensitive information, including Social Security numbers, medical records and financial details, making them valuable targets for identity theft and fraud,” he said.

“These systems provide essential services such as Medicaid, SNAP and other health benefits, which means they are critical infrastructure that the ‘bad guys’ – internal or external – can exploit them to cause significant disruption to the beneficiaries, care providers and to the agency and the state sponsors,” he said.

But in the meantime, state governments often operate with limited cybersecurity resources and budgets, making it challenging to implement robust security measures – including staffing, tools or time, Finn said.

“These systems are designed to be accessible to the public, which can create vulnerabilities that attackers – internal or external – can exploit. Employees with access to these systems may misuse their access for personal gain or out of malice, leading to data breaches.”