Youth Sports, NCAA Insurance Claims Potentially Hacked

A Maine-based third-party administrator that handles healthcare claims involving day care centers, youth sports and NCAA athlete accidents is notifying more than 181,000 claimants that their medical information and personal identifiers may have been accessed or stolen in an April hacking incident.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

National Accident Health General Agency, or NAHGA, describes itself as a third-party administrator that focuses on secondary accident insurance claims processing for clients across the country.

The company, which has been in business more than 30 years, handles claims involving specialty organizations and large health insurers that cater to day care centers; youth sports and camps for K-12 students; athletic programs such as the NCAA Divisions I, II and III; national film and television productions; and motocross and short track auto racing.

NAHGA, in a breach report submitted to Maine’s attorney general on Friday, said the hacking affected 181,160 people.

In a breach notice posted on NAHGA’s website, the company said that on April 10, it “learned” of unusual activity within its network.

NAHGA said it then immediately took measures to investigate the activity and secure its systems.

With the help of third-party cybersecurity experts, the investigation determined that an unauthorized individual may have accessed or acquired certain files and data stored within NAHGA’s systems between April 8, and April 11.

“NAHGA conducted an extensive review of these systems in order to identify the scope of the incident,” the company said, adding that it started sending breach notices to affected individuals with an available mailing address on Nov. 14.

NAHGA’s review of the compromised data found that affected information may have included individuals’ name, Social Security number, date of birth, driver’s license number, health insurance information and medical or treatment information.

NAHGA said it has taken steps to enhance its security to help reduce the risk of similar incidents in the future.

NAHGA did not immediately respond to Information Security Media Group’s request for additional details involving the company’s breach.

Several national law firms in recent days and weeks have issued public notices saying they are investigating the NAHGA breach for potential class action litigation. As of Monday, at least one such federal proposed class action lawsuit had been filed against NAHGA stemming from the incident.

That lawsuit alleges, among other claims, that NAHGA’s weak security practices failed to stop cybercriminals from accessing and exfiltrating the personally identifiable information and protected health information in its care.

“Because of defendant’s data breach, the sensitive PII/PHI of plaintiff and class members was placed into the hands of cybercriminals – inflicting numerous injuries and significant damages upon plaintiff and class members,” the complaint alleges.

That lawsuit against NAHGA seeks financial damages, including compensatory and putative, as injunctive relief requiring the company to better protect plaintiffs and class members’ personal and health information.

As of Monday, the NAHGA incident was not yet posted on the U.S. Department of Health and Human Services’ HIPAA Breach Reporting Tool listing major health data breaches affecting 500 or more individuals.

Nonetheless, the NAHGA incident is among hundreds of other large breaches – including hacking incidents – reported by third-party vendors and business associates to the HHS Office for Civil Rights so far in 2025.

The largest such HIPAA business associate incident reported in 2025 so far was a hacking incident at Episource, a medical coding and risk adjustment company owned by health insurer UnitedHealth Group’s Optum subsidiary (see: UnitedHealth Group’s Latest Health Data Breach).

That Episource breach, reported to HHS OCR on June 6, affected more than 5.4 million people. Episource in its breach notice said that the company detected unusual activity on its computer network on Feb. 6. The company said its investigation into the incident determined that cybercriminals accessed and stole copies of some Episource data between Jan. 27 and Feb. 6.