Insurer Notifying 335,500 Customers, Agents, Others of Hack

A Texas-based insurance firm is notifying more than 335,500 people of a December hacking incident involving the access and copying of their sensitive personal and health information. The hack affects many – but not all – of the company’s policyholders, agents and insurance carrier partners in multiple states.

See Also: Top 10 Technical Predictions for 2025

New Era Life Insurance Companies, which is based in Texas but also has operations in the Midwest and Pennsylvania, identified itself as a health plan in its HIPAA breach report filed to federal regulators on Feb. 11.

New Era Enterprises – which includes New Era Life Insurance – also filed a breach report to Maine’s attorney general that same day saying the hack affected 16 state residents, including employees, policyholder beneficiaries and independent agents. New Era also filed similar breach reports to several other states, including South Carolina.

The company in its breach notice said it identified suspicious activity within its network on Dec. 18. “We immediately initiated our incident response protocols, which included isolating certain systems and beginning an investigation with assistance from a third-party cybersecurity firm.” New Era said it also notified law enforcement.

The investigation into the incident determined that an “unauthorized person” accessed the company’s network for more than a week – between Dec. 9 and Dec. 18 – during which the intruder accessed and copied some files from some of New Era’s systems.

The analysis of affected data identified files containing information of certain policyholders, agents and insurance carrier partners, New Era said. The information compromised varied by individual, but included names, dates of birth, insurance ID numbers, and claim information such as medical diagnosis or treatment information. Social Security numbers for some individuals were also affected, the company said.

“Importantly, this incident did not involve all New Era policyholders, agents and insurance carrier partner data – but only those whose data was contained in the files involved,” the company said.

Several class action law firms in recent days have issued public notices that they are investigating the New Era data breach for potential lawsuits.

An attorney representing New Era in its breach report did not immediately respond to Information Security Media Group’s request for additional details about the company’s data security incident.

The company is offering affected individuals 12 months of complimentary identity and credit monitoring. Also, to help prevent similar future incidents, New Era said it has implemented, and will continue to adopt, additional safeguards and technical security measures.

Health Plan Hacks

As of Friday, the New Era hacking incident was by far the largest health data breach of 10 incidents reported by health plans to the U.S. Department of Health and Human Services so far the year.

Taking into account the total 122 major health data breaches reported so far in 2025 by all types of HIPAA regulated entities, the New Era incident ranks as the fourth largest breach.

Health plans are often targets for hacking incidents and other cybercrime compromises because of the volume and range of valuable health and other personal information they handle and hold for a large swath of individuals, experts said.

In 2024, health plans reported 78 major breaches to federal regulators, affecting nearly 17.7 million people.

Those figures excludes breaches reported by business associates that serve the health insurance sector, including IT services provider Change Healthcare – a unit of UnitedHealth Group – which reported a record-breaking breach affecting 190 million people last year tied to its massively disruptive ransomware attack.

“HIPAA regulates health plans of various sizes, from large health insurance companies to small employer-sponsored group health plans,” said regulatory attorney Paul Hales of the Hales Law Group. “Large commercial insurers generally have strong cybersecurity. However, their size permits vulnerabilities. A phishing email kicked off the massive 2016 Anthem Inc. breach,” he notes, which affected nearly 79 million individuals and held the record as largest U.S. health data breach for nearly a decade until the Change Healthcare hack last year.

Other experts agree that health plans and other related entities are highly appealing to cybercriminals.

“These organizations store sensitive personal information, including Social Security numbers, medical histories, and financial details. Such data can be sold on the dark web or used for identity theft and financial fraud,” said former healthcare CIO David Finn, principal owner of consulting firm Cyber Health Integrity.

“Beyond financial gain, some attacks are politically or ideologically motivated, targeting healthcare systems to cause widespread disruption,” he said. “Cybercriminals know that disrupting healthcare operations can have life-or-death consequences. This urgency often compels organizations to pay ransoms quickly to restore services,” he said.

On top of that, many healthcare-related organizations still rely on outdated software and infrastructure, making them vulnerable to exploitation. “The shift to cloud-based data management, while efficient, introduces vulnerabilities if not properly secured,” he added.

Many health plans often face similar challenges to hospitals and healthcare systems when it comes to cybersecurity, though the degree and specifics can vary, Finn said. “The key issues here include resource limitations. Like hospitals, health plans may lack adequate funding or skilled personnel to implement robust cybersecurity measures,” he said.

These organizations often prioritize operational needs over digital defenses, leaving vulnerabilities unchecked, he said. Healthcare is also the “most hyper-connected” sector of all the critical infrastructure sectors, he said. “Both health plans and healthcare systems deal with complex networks of data-sharing – whether between providers, payers or third parties. This creates multiple entry points for cyberattacks.”

That said, there are some important differences between health plans and hospitals when it comes to risk, he said.

Larger health plans, particularly national ones, may have more robust budgets and cybersecurity infrastructure compared to smaller hospitals or rural providers. Also, health plans may have less real-time operational pressure compared to hospitals that need constant, immediate access to patient data for care delivery.

“Both health plans and providers face significant cybersecurity hurdles, and in both cases the scale and nature of these issues often depend on organizational size, resources and priorities.”

Hales offered a similar assessment. “The content of protected health information and personally identifiable information, which are handled by health plans of all types, makes them prime targets for criminals,” he said.

“Because small group health plans often lack rigorous HIPAA safeguards, they are vulnerable to attack and can provide criminals with a backdoor to invade large health insurance underwriters.”