Two U.S. health care companies, Clover Health Investments in New Jersey and AngMar Management Services in Texas, have disclosed data breaches that together affect nearly 265,000 people, SecurityWeek reported Monday. Both incidents involved medical and insurance information, and one has been claimed by the Interlock ransomware group.

What Happened

Clover Health, based in Jersey City, New Jersey, said 138,677 people were affected. According to SecurityWeek, attackers used social engineering to take over three accounts belonging to non-managerial employees in early July. The data exposed includes names, dates of birth, insurance identifiers, account numbers and other personal and protected health information. The report did not tie the Clover intrusion to any known group.

AngMar Management Services, of Mansfield, Texas, provides back-office support to home health and hospice providers. It said 126,196 people were affected. The company detected suspicious activity in mid-July and confirmed in early September that data had been taken. The exposed records include names, dates of birth, Social Security numbers, diagnoses, medical histories, health insurance details, patient IDs, provider names, prescription information and dates of service.

RelatedCybersecurity Incident at BAE Systems Halts Notices From U.S. Bankruptcy Courts

The Interlock ransomware group claimed the AngMar attack in August, adding the company to its leak site and saying it had stolen more than 700 gigabytes of data.

Both companies reported the incidents to the Department of Health and Human Services in mid-September, AngMar on Sept. 16, and both appeared on the agency's public breach portal last week.

Why It Matters

The two cases show two common routes into health care data. At Clover, the entry point was people rather than software: attackers manipulated employees to gain a foothold in their accounts, which then exposed member records. At AngMar, a vendor that sits behind many care providers held a deep set of clinical and identity data, including Social Security numbers, and became a ransomware target.

The AngMar data is the more dangerous combination. Social Security numbers paired with diagnoses and insurance details can be used for identity theft and medical fraud, and unlike passwords they cannot be changed. Patients of the home health and hospice agencies AngMar serves may not have known the company held their records at all, since they dealt with their providers rather than with AngMar.

Interlock has been active against health care organizations and typically threatens to publish stolen files when victims do not pay.

Context

Clover Health is a publicly traded insurer focused on Medicare Advantage plans, so many of its members are older adults. Insurance identifiers and dates of birth are the kind of details scammers use to make calls about benefits or claims sound legitimate.

In both cases roughly two months passed between the first sign of trouble in July and the filings with regulators in September. HIPAA generally requires covered entities to notify affected individuals within 60 days of discovering a breach.

What to Watch

Affected individuals are being notified. Watch for whether Interlock publishes the AngMar data it claims to have, whether either company offers credit or identity monitoring, and whether class action lawsuits follow, as they often do after health care breaches of this size.