Fieldtex, TriZetto Reveal New Healthcare Breaches

A Rochester, New York-based medical supply fulfillment company that provides products to patients through their health insurance plans is notifying its clients and more than 274,000 people about an August hacking incident that potentially compromised their protected health information.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

Fieldtex Products submitted four separate breach reports – one on Nov. 20 and three on Dec. 3 – to the U.S. Department of Health and Human Services’ Office for Civil rights about the hacking incident that shows at least 274,363 people were affected.

Fieldtex filed the reports to federal regulators as a HIPAA business associate. The company in its breach statement said it is notifying affected individuals on behalf of health plan clients that have authorized Fieldtex to provide direct notice.

Besides Fieldtex, another HIPAA business associate – TriZetto Provider Solutions, a revenue cycle management software firm owned by Cognizant, confirmed this week that it also has begun notifying an undisclosed number of clients and their patients about a recent hacking incident. As of Friday, the company appeared to have not yet issued a public breach notice about the incident.

Fieldtex Breach

Fieldtex describes itself as a medical supply fulfillment organization that provides over the counter, healthcare-related products to members through their health plans. “In order to deliver these services, Fieldtex received certain protected health information from the members’ health plans,” the company’s breach statement said.

Fieldtex said that on or around Aug. 19, it discovered certain unauthorized activity within its computer systems. “Upon discovery, Fieldtex immediately secured its network and swiftly engaged a third-party team of forensic investigators in order to determine the full nature and scope of the incident.”

The forensics investigation could not rule out the possibility that an unknown actor may have accessed individuals’ PHI. “There is no indication whatsoever that any information has been misused at this time,” Fieldtex said.

The information contained within the affected data included patient names, addresses, dates of birth, insurance member identification numbers, plan names, effective terms and gender.

On Sept. 30, Fieldtex finalized its analysis of the potentially impacted data and immediately began notifying the corresponding health plans, the company said.

Fieldtex said it is offering complimentary credit monitoring services to individuals whose information may have been compromised in the incident.

“Additionally, in response to this incident, Fieldtex has implemented additional security measures within its network and is reviewing its current policies and procedures related to data security,” the company said.

Fieldtex did not immediately respond to Information Security Media Group’s request for additional details about the hacking incident, including whether threat actors exfiltrated data or demanded a ransom.

Other Vendor Hacks

TriZetto Provider Solutions in a statement Friday to ISMG said that on Oct. 2, the company became aware of suspicious activity within a web portal that some of its healthcare provider customers use to access its systems.

“We quickly launched an investigation, took steps to mitigate the issue and eliminated the threat to the environment,” the statement said. “We have also engaged external cybersecurity experts, Mandiant, and notified law enforcement. We have notified affected customers and patients and provided them with the support and the information they need.”

TriZetto did not immediately respond to ISMG’s request for additional details about the incident and did not appear to have issued a public breach notice.

As has been the case for many years, business associates that handle HIPAA-protected health information were at the center of many of the largest breaches reported so far in 2025. As of Friday, the HHS OCR website shows 218 breaches involving business associates, affecting nearly 18.3 million individuals.

Those HHS OCR figures on Friday do not reflect the current tally of people affected by a hacking incident first reported to federal regulators in October by Conduent Business Services, a business associate that provides back office services to businesses such as health plans.

Conduent reported the incident to HHS OCR on Oct. 8 as affecting 42,616 individuals. But Conduent a few weeks later – in the midst of the U.S. federal government shutdown – reported to Oregon’s state attorney general that the breach actually affected 10.5 million individuals (see: Lawsuits, Investigations Piling Up in Conduent Hack).

As of Friday, HHS OCR had not yet posted on its HIPAA breach reporting website Conduent’s updated figures regarding the number of people affected by its hack.