Massive Data Breach at Healthcare Interactive (HCIactive) Affects Over 3 Million Individuals
Massive Data Breach at Healthcare Interactive Affects Over 3 Million, Including 103,000 SC Residents Healthcare Interactive, Inc.
Key points
- Over 3 million individuals affected nationwide (3,056,950 confirmed).
- Exposed information may include names, addresses, phone numbers, email addresses, dates of birth, Social Security numbers, health plan/policy numbers, member/group IDs, health insurance claim numbers, account numbers, billing codes, explanation of be
- Unauthorized access period: June 17, 2025, to July 22, 2025.
Connected intelligence
Signal brief
Follow the organization, likely method and potential impact to explore connected Shadow Tier intelligence.
- Published
- Jun 17, 2025
- Updated
- Jul 22, 2026
- Confidence
- Medium
- Evidence
- 2 sources
Structured assessment
Signal analysis
This analysis groups the signal by industry, likely incident action and impacted security area. It helps compare this signal with other published signals without treating the labels as final determinations.
Threat source
Watch internet-facing systems, credential abuse and exploit activity.
Business impact
- Impact area
- Confidentiality
- Likely asset
- User or customer data
Mentioned entities
Quick context
Questions about this signal
What happened in this signal?
Massive Data Breach at Healthcare Interactive Affects Over 3 Million, Including 103,000 SC Residents Healthcare Interactive, Inc. (HCIactive), an Ellicott City, Maryland -based provider of AI-powered software solutions for insurance enrollment and benefits administration, has experienced one of the largest healthcare data breaches of 2025. The breach has compromised the personal and protected health information of over 3 million individuals nationwide, including 103,000 residents of South Carolina . As required by law, HCIactive has notified the South Carolina Department of Consumer Affairs and has begun sending notification letters to affected residents. HCIactive first identified suspicious activity on its computer network on or around July 22, 2025 . According to the company's notice of security incident, an investigation determined that an unauthorized actor had access to their network and copied certain files between July 8, 2025 , and July 12, 2025 . However, information provided to the Oregon Attorney General suggests the unauthorized access may have spanned a longer period, from June 17, 2025 , to July 22, 2025 . HCIactive initially reported the breach to the HHS' Office for Civil Rights on September 22, 2025 , using a placeholder figure while the review of affected data was ongoing. As the investigation progressed, the staggering scope of the breach became clear. By January 2026 , it was confirmed that 3,056,950 individuals were affected, making it the 5th largest healthcare data breach of 2025. The type of data compromised varies by individual but is extensive and highly sensitive. Exposed information may include: Health plan/policy numbers and health insurance provider names Member/group IDs and health insurance claim numbers Explanation of benefitsMedical data, including diagnoses, treatment information, prescriptions, lab results, medical images, care information, doctors' names, and medical record numbers. While HCIactive states they are not aware of any actual or attempted misuse of the stolen information, the sheer volume and sensitive nature of the data present a significant risk for identity theft and medical fraud. The threat actor behind the attack remains unknown. In response to the breach, HCIactive states they have worked quickly to secure their systems. They have implemented additional technical security measures and are reviewing and enhancing their existing policies and procedures to prevent future incidents. In a December 2025 press release, the company announced structural changes to support their "AI First and AI Everywhere" mission, which includes expanded leadership oversight around AI security, zero trust enforcement, AI-driven anomaly detection, modernization of encryption, and stricter compliance oversight. As an added precaution, HCIactive is offering complimentary credit monitoring services through Cyberscout , a TransUnion company, to affected individuals. Due to privacy restrictions, individuals cannot be automatically enrolled and must sign up for the service using the unique code provided in their notification letter. If you received a notification letter from HCIactive, it is crucial to take immediate steps to protect yourself: Enroll in the Complimentary Credit Monitoring: Follow the instructions in your letter to enroll in the free credit monitoring services offered through Cyberscout . You must enroll within 90 days of the date on your letter. Monitor Your Accounts Closely: Remain vigilant by regularly reviewing your free credit reports, account statements, and explanation of benefits forms for any suspicious activity or errors. Request Free Credit Reports: You are entitled to one free credit report annually from each of the three major credit bureaus (Equifax, Experian, and TransUnion ). Visit www.annualcreditreport.com or call 1-877-322-8228 to request yours. Consider a Fraud Alert or Credit Freeze: You have the right to place a free initial or extended "fraud alert" on your credit file. Alternatively, you can place a "credit freeze" on your report, which prohibits credit bureaus from releasing information without your express authorization. Contact the major credit reporting bureaus to set these up. Report Suspicious Activity: Any suspected identity theft or fraud should be promptly reported to the applicable institution, law enforcement, your state Attorney General, and the Federal Trade Commission (FTC). The FTC can provide further resources on identity theft protection and can be reached at www.identitytheft.gov or 1-877-ID-THEFT. Feeling lost in the digital world? Dr. Tom is here to help! Gov. Braun signs bipartisan Medicaid Reform bill into law Wellmark still worries over temporary tax hike How can more Americans achieve financial independence?
When was this signal reported?
Shadow Tier lists Jun 17, 2025 as the signal date.
Which organization is connected to this signal?
Hciactive is the organization connected to this public signal.
Explore HciactiveWhich impact area is relevant?
This signal is connected to data exposure and breach intelligence based on its reported consequences.
Explore data exposure and breach intelligenceWhich sector context is relevant?
This signal is connected to healthcare cyber intelligence.
Explore healthcare cyber intelligenceRelated signals
Compare shared topics, actors and incident patterns before opening the full signal.
Origin Energy Discloses Data Breach Affecting 900,000 Customers
On July 28, 2026, Origin Energy, a major Australian energy company, publicly confirmed a significant data breach impacting approximately 900,000 current and former customers. The breach led to unauthorized access and exfiltration of personally identifiable information (PII), including names, addresses, dates of birth, phone numbers, account details, and partial payment information such as the last four digits of credit cards or the BSB and last three digits of bank accounts. Origin Energy first identified a potential security threat in early July 2026, which was initially not deemed credible. However, new information on July 22, 2026, confirmed a security incident had occurred, prompting immediate action and notification of authorities. An alleged hacker provided a media outlet with a sample of 50 customer records and screenshots of internal Origin Energy systems, corroborating the data exfiltration. The incident is currently under investigation by Australian authorities, including the Australian Cyber Security Centre, the National Office of Cyber Security, the Australian Federal Police, and the Office of the Australian Information Commissioner. The specific technical vector used for initial access remains undisclosed.
Related context
DoorDash Confirms Data Breach After Social Engineering Attack
DoorDash, the popular food delivery platform, publicly acknowledged a cybersecurity incident that compromised the personal information of an undisclosed number of users. The breach, which occurred on October 25, was a result of a social engineering attack targeting a company employee. This allowed an unauthorized third party to gain access to DoorDash's internal systems. The compromised data varied by individual but potentially included first and last names, phone numbers, email addresses, and physical addresses of customers, Dashers (delivery drivers), and merchants across the United States, Canada, Australia, and New Zealand. DoorDash emphasized that no sensitive financial information, such as Social Security numbers, government-issued IDs, driver's license details, bank information, or payment card data, was accessed. The company's security team identified and shut down the unauthorized access shortly after its detection, launched an internal investigation, and notified law enforcement. DoorDash has also implemented multiple security enhancements, including upgraded security systems and additional employee training programs focused on social engineering awareness. While the company has stated there is no indication the data has been misused for fraud or identity theft, affected users are advised to be cautious of unsolicited communications requesting personal information. This incident marks DoorDash's third known cybersecurity incident in six years, highlighting the persistent threat of social engineering attacks.
Related context
South Korean Diplomatic Academy Suffers Significant Data Leak Affecting 10,000 Diplomats
On July 21, 2026, the Korea National Diplomatic Academy, an institution affiliated with South Korea's Ministry of Foreign Affairs, confirmed a significant data leak impacting approximately 10,000 records of current and retired diplomats. The breach, which occurred in the academy's online education system, was discovered in early February 2026 after suspicious access was reported by a government agency. An unidentified attacker exploited a zero-day vulnerability in the server software and weaknesses in system security settings, maintaining unauthorized access from April to May 2025 until February 2026. The compromised data reportedly included names, user IDs, email addresses, encrypted passwords, job titles, and affiliated departments. While sensitive personal information such as resident registration numbers, mobile phone numbers, and home addresses were not present on the affected server, the leak of diplomat information raises concerns, especially given that the full list of diplomats and personnel at overseas missions is not publicly disclosed. The Foreign Ministry is investigating the incident and has urgently shut down the compromised system. They are operating under the assumption that a substantial volume of data was compromised, though the exact scale of the damage is still being assessed. The incident highlights the challenges in detecting sophisticated attacks that leverage previously unknown vulnerabilities.
Related context
CTIVD: AIVD en MIVD verwerken persoonsgegevens in bulkdata onrechtmatig
The Dutch intelligence services, AIVD and MIVD, have unlawfully processed personal data in bulk datasets, according to a ruling by the Committee for the Supervision of the Intelligence and Security Services (CTIVD). The report, published on July 1, 2026, states that groups of employees had unauthorized access to personal data, and large quantities of data were stored for too long. The bulk datasets, sometimes containing millions of records, include names, phone numbers, location data, social media data, and communication content, sourced from government agencies, commercially available datasets, or stolen datasets offered by criminals. The CTIVD has issued thirteen recommendations to improve the situation.
Related context
NIFTY Corporation Affected by KDDI Corporation Data Breach
NIFTY Corporation, a Japanese internet service provider, was impacted by a data breach originating from an email system provided by KDDI Corporation. Threat actors gained unauthorized access to this shared system by exploiting a vulnerability in third-party software. This led to the potential exposure of up to 14.2 million email addresses and passwords across all affected ISPs. NIFTY Corporation customers' email addresses and passwords may have been compromised.
BIGLOBE Inc. Affected by KDDI Corporation Data Breach
BIGLOBE Inc., a Japanese internet service provider, was impacted by a data breach originating from an email system provided by KDDI Corporation. Threat actors gained unauthorized access to this shared system by exploiting a vulnerability in third-party software. This led to the potential exposure of up to 14.2 million email addresses and passwords across all affected ISPs. BIGLOBE Inc. customers' email addresses and passwords may have been compromised.