Health Analytics Firm Reports Breach Affecting 1.1 Million

A Maine consulting firm with a medical data analytics business must notify more than 1 million individuals that hackers stole their information from company servers.

See Also: 13 Essential Criteria to Consider For Cyber Resilience in IR & SoC Teams

Berry, Dunn, McNeil & Parker on Thursday submitted a data breach notification to the Maine attorney general’s office stating that it is notifying 1.1 million U.S. residents that such information as their name, address and driver’s license number or non-driver identification card number was exposed in the data breach.

The breach involved BerryDunn’s Health Analytics Practice Group. Portland-based BerryDunn couldn’t be immediately reached for comment about whether the breach exposed any other personal identifiable details for individuals, such as health information. The company is offering all affected individuals at least 12 months of prepaid identity theft monitoring.

The company’s website says its analytics group works with government regulatory and healthcare policy agencies, insurers and providers to help them test policies and programs, backed in part by analyzing health insurance claims data.

Which specific clients of BerryDunn – and by extension, their customers or members – have been affected by the breach isn’t clear, but dozens or hundreds of organizations could be involved.

UPMC Health Plan, which has 3.9 million members and is owned by the University of Pittsburgh Medical Center, last year flagged BerryDunn’s initial breach notification, saying it “may have impacted some members’ protected health information.”

In a notice posted to BerryDunn’s website late last year, the company said its managed service provider, Reliable Networks of Maine, reported that it “had discovered suspicious network activity that was impacting its network, including systems it managed on behalf of HAPG.” The initial notification said the intrusion appeared to have begun on Sept. 12 and may have led to data being stolen.

Immediately after receiving an alert from Reliable, BerryDunn said, it launched an incident response investigation and brought in outside cybersecurity experts, who eventually confirmed that a hacker accessed its MSP’s systems and stole HAPG data.

BerryDunn said it subsequently “hired a vendor to conduct an in-depth review of the impacted data to determine what personal information may have been impacted and identify any individuals for whom the personal information belongs,” and the review concluded on April 2.

In response to the breach, BerryDunn said, it and migrated all of its HAPG data “to secure internal BerryDunn systems that are continually monitored as part of our cybersecurity program” and decommissioned all systems formerly being managed by Reliable.

Reliable couldn’t be immediately reached for comment.