Healthplex, Part of UnitedHealth Group, Lacked MFA on Compromised Email Account
New York State has fined a dental plan administrator owned by insurer UnitedHealth Group $2 million for failing to protect data with multifactor authentication and other issues related to a phishing breach that affected 90,000 people. It’s the state’s second fine against Healthplex for the same breach.
See Also: What Manufacturing Leaders Are Learning About Cloud Security – from Google’s Frontline
New York State Department of Financial Services announced the state’s latest action against Uniondale, New York-based Healthplex on Thursday, saying that the company violated state cybersecurity regulations, including by failing to implement MFA for Office 365 email access from an external browser.
The recent settlement between the state’s Department of Finance and Healthplex is the second enforcement action against the company by New York regulators for the data breach. In December 2023, New York’s attorney general fined Healthplex $400,000 for similar findings in that office’s investigation into the same phishing incident (see: Dental Plan Administrator Fined $400K for Phishing Incident).
In late 2021, a Healthplex customer service employee received and clicked on a phishing email that granted threat actors access to all of the consumer data in the employee’s email account, according to state representatives.
The incident compromised the “non-public information,” or NPI of tens of thousands of New York residents, including names, addresses, dates of birth, Social Security numbers, financial information, driver’s license numbers and personal health information, the state said.
“While Healthplex had MFA in place on its previous email environment, when it migrated to Office 365 earlier in 2021, Healthplex failed to ensure that the MFA function was completely operational for those accessing O365 from an external web browser,” in violation of state cybersecurity regulations, the state said.
The state’s investigation also found that Healthplex had no data retention policy to limit the storage of emails in Microsoft Outlook.
“Health insurance providers are entrusted with highly sensitive personal information and health data of policyholders,” said Adrienne Harris, New York State’s Department of Financial Services superintendent. The department’s cybersecurity regulation requires insurers and other regulated organizations to maintain and implement robust cybersecurity policies, so the private information New Yorkers entrust to them is protected, she said. “Healthplex’s failure to adhere to these rules resulted in the exposure of the sensitive data of tens of thousands of consumers.”
Lacking MFA
UnitedHealth Group acquired Healthplex in December 2020, about a year before the Healthplex phishing incident.
Similarly, UHG had acquired in 2023 IT services unit Change Healthcare, which was also about a year before Change Healthcare experienced a massive ransomware attack in February 2024 that the company said also involved threat actors accessing a Change Healthcare IT external-facing legacy system that lacked of MFA (see: Lawmakers Grill UnitedHealth CEO on Change Healthcare Attack).
Although UHG has said the use of MFA is a standard best practice at the company, Change Healthcare had not yet fully transitioned security controls of all its legacy IT systems by the time BlackCat/Alphv ransomware attackers accessed Change Healthcare’s IT environment.
In a statement provided to Information Security Media Group, a UHG spokesperson said, “protecting member privacy is a top priority for Healthplex. We’re pleased to have reached a resolution and are grateful for the New York State Department of Financial Services’ cooperation.”
UHG did not immediately respond to ISMG’s request for details on how UHG handles and transitions to its best practices the IT security controls of companies that the Minnesota-based healthcare insurer acquires.
Besides the multi-million fine, under the settlement with the state, Healthplex has agreed to strengthen its security controls and undergo an audit to ensure its use of MFA complies with New York cyber regulations.
That includes the audit assessing Healthplex’s MFA related to the integrated infrastructure in which the company’s business operates and shared systems that support Healthplex’s core business functions, such as Office 365, Azure cloud and its claims system.