Newkirk Products, a company that issues ID cards for health insurance plans, including a number of Blues plans, reported a data breach after a server containing member information was accessed without authorization. Approximately 3.3 million individuals were affected by the breach.
The company discovered the unauthorized server access July 6. Upon learning of the incident, Newkirk shut down the server, launched an investigation into the incident and hired a third party investigator to determine the extent of the breach. The unauthorized access is believed to have first occurred May 21. The investigation is ongoing.
Potentially compromised data includes a combination of member's names, mailing addresses, type of plan, member and group ID number, names of dependents, primary care providers, birth dates, invoice information and Medicaid ID number. No Social Security numbers, banking or credit card information, medical information or insurance claims were contained on the server.
Newkirk issues ID cards for plans including Blue Cross and Blue Shield of Kansas City, Blue Cross Blue Shield of North Carolina, HealthNow New York Inc., BlueCross BlueShield of Western New York, BlueShield of Northeastern New York and Capital District Physicians' Health. Additionally, Newkirk provides service to Gateway Health Plan, Highmark Health Options, West Virginia Family Health, Johns Hopkins Employer Health Programs, Inc., Priority Partners Managed Care Organization and Uniformed Services Family Health Plan.
The company indicates no health plans' systems were accessed or affected. And it says while the data may have been accessed on the server, there is no evidence it has been inappropriately used.
More articles on data breaches:
Oregon State Hospital reports breach after clinician texts patient medical data
Carle Foundation Hospital breach affects 1,185 patients
Physician files class-action lawsuit against Banner over data breach