Managed Care of North America Hacking Incident Impacts 8.9 Million Individuals

Posted By Steve Alder on May 30, 2023

Managed Care of North America, Inc. (MCNA), which also does business as MCNA Dental –  a provider of dental benefits and services for state Medicaid and Children’s Health Insurance Programs – has recently reported a major data breach to the Maine Attorney General that has affected 8,923,662 individuals. This is the largest healthcare data breach to be reported by a single covered entity so far this year, and the second 5 million record+ healthcare data breach to be reported this month.

On March 6, 2023, MCNA discovered an unauthorized third party was able to access certain systems within its IT network. The threat was immediately contained and a third-party cybersecurity firm was engaged to investigate the intrusion and determine the nature and scope of the incident. The forensic investigation determined that the network had been compromised and infected with malicious code and that the attackers removed some copies of personal and protected health information from its systems between February 26, 2023, and March 7, 2023.

The review of the files that were copied or potentially accessed confirmed that they contained protected health information such as names, addresses, telephone numbers, email addresses, birth dates, Social Security numbers, driver’s license numbers, government-issued ID numbers, health insurance information, Medicare/Medicaid ID numbers, group plan names and numbers, and information related to the dental and orthodontic care provided. The types of compromised information varied from individual to individual. MCNA said it is unaware of any attempted or actual misuse of the affected data. MCNA said it has enhanced its security controls and monitoring practices to minimize the risk of further incidents of this nature in the future.

The LockBit ransomware group claimed responsibility for the attack and leaked some of the stolen data on its dark web data leak site as proof of data theft, and demanded a $10 million ransom to prevent the publication of all of the stolen data. It appears that the ransom was not paid, as the group published the stolen files on April 7, 2023.

Get The FREE
HIPAA Compliance Checklist

Immediate Delivery of Checklist Link To Your Email Address

Business Email *

Name *

First

Last

Number *

Company Name *

Get Free Checklist

Please Enter Correct Email Address

Your Privacy Respected

HIPAA Journal Privacy Policy

Affected individuals are now being notified and are being offered complimentary credit monitoring services for 1 or 2 years, dictated by the minimum terms required by state laws. MCNA sent notifications on behalf of Florida Healthy Kids Corporation, the Florida Agency for Health Care Administration, and the following 112 insurance plans: