Ciox / Datavant Data Breach

Datavant identified suspicious activity in its email environment on May 9, 2024. Its investigation found that phishing messages had been sent to a limited number of users and that one employee's response allowed an attacker to access a single email account from May 8 to May 9.

The company reviewed affected messages and attachments to identify the people and data controllers within scope. Relevant parties and individuals were notified after that work was completed.

The categories varied by person. Disclosed fields included names, dates of birth, addresses and contact information, and Social security numbers.

Financial account details, driver's license and passport numbers, health information, account credentials, and digital signatures may also have been involved for some people. Not every category applied to every affected individual.

The current HHS Office for Civil Rights breach record reports 320,702 affected individuals. Earlier notices carried smaller interim totals; this catalog entry uses the updated federal total for the same event and does not add those earlier figures separately.

Social security numbers combined with dates of birth and addresses can increase the risk of identity theft or fraudulent account applications. Financial-account and government-identity information can also be used in fraud attempts.

Health information and stolen email context may help an attacker impersonate a company, healthcare provider, or financial institution in a convincing message. Unexpected communications should be verified through an independent official channel.

Datavant said it conducted a forensic investigation, reconfigured email security settings, implemented additional technical safeguards, and updated security-software rules. Eligible individuals were offered identity monitoring and protection services.

Notice recipients can monitor credit reports and financial accounts for unfamiliar activity. If a Social Security number was involved, a credit freeze or fraud alert may be appropriate.

Before opening links in an unexpected request that uses identity-document or health details, recipients should verify the sender independently. Suspected financial, medical, or identity misuse should be reported directly to the relevant institution.