2026 Health Payment Systems — email compromise Jun 24–27 2025; 9,380 OCR (Jul 2026)
Data compromised
Names, addresses, birth dates, IDs, subscription/subscriber IDs; for some: medical info, health insurance, SSNs. 9,380 individuals per OCR/HIPAA Journal.
Technical writeup
Verified OCR-notified email breach — HHS OCR informed July 10, 2026; HIPAA Journal August 11, 2026. Health Payment Systems identified suspicious email activity around June 27, 2025 and confirmed unauthorized access to employee mailboxes between June 24 and June 27, 2025 with some emails copied. After lengthy review, 9,380 individuals were notified; data included names, addresses, DOB, IDs, and for some medical/insurance information and SSNs. Credit monitoring offered. BreachHistory indexes recordsAffected 9380.
Root cause
Unauthorized access to certain employee email accounts June 24–27, 2025; emails copied; discovered ~June 27, 2025