Minnesota Agency Notifies 304,000 of Vendor Breach

The Minnesota Department of Human Services is notifying nearly 304,000 people of a data breach involving someone at a healthcare provider who inappropriately accessed information from an IT system managed by a vendor. State officials are monitoring the incident for potential fraud.

See Also: Using the Netskope HIPAA Mapping Guide

The Minnesota agency said the incident involved its MnChoices system, which is used by counties, tribal nations and managed care organizations to assess adults, children and families’ eligibility for long-term services and support, including disability assistance, food and housing assistance, and mental health services.

The MnChoices system is managed for the state by third-party vendor, FEI Systems.

FEI detected on Nov. 18, 2025, “unusual user activity” and reported its finding to DHS the next day. The firm determined that from Aug. 28, 2025, to Sept. 21, 2025, a user affiliated with a licensed healthcare provider accessed data in the MnChoices system without authorization.

The state agency said it “removed” the healthcare provider’s access to MnChoices on Oct. 30, 2025.

“While FEI confirmed the user was authorized to access limited data in the system, the user accessed more data than was reasonably necessary to perform work assignments.” FEI hired a cybersecurity company to conduct an additional forensics investigation of the incident, at the state government’s request.

The incident affected the demographic information for about 303,965 individuals, and additional information for 1,206 of those individuals.

The investigation determined data potentially accessed include first name, last name, alternative names, address, email addresses, sex, date of birth, phone number, Medicaid ID, last four digits of Social Security numbers, ethnicity, race, birth record, physical traits, education, income, benefits, Medicaid information, financial eligibility, program eligibility, lock-in data and spenddown data.

The state agency said there appears to be no evidence of external hacking. “The DHS Office of Inspector General is aware of this incident and has developed data-driven processes to monitor and evaluate billing information, in an effort identify whether there was fraudulent or inappropriate use of the accessed data,” it also said.

DHS said it reported the incident to the Minnesota Office of the Legislative Auditor and to the U.S. Department of Health and Human Services as a HIPAA breach. “Because the user was not a DHS employee, there was not a final disposition of disciplinary action” the state agency said.

FEI did not immediately respond to Information Security Media Group’s request for comment and additional details about the incident.