250,000 Impacted by Data Breaches at New Jersey, Texas Healthcare Firms
250,000 patients affected by separate July breaches at Clover Health and AngMar Management Services.
Summary
Clover Health Investments (New Jersey) and AngMar Management Services (Texas) reported separate data breaches affecting over 250,000 patients combined. Clover Health was compromised in early July via social engineering targeting three employee accounts, exposing names, dates of birth, insurance identifiers, and account numbers from 138,677 individuals. AngMar Management Services discovered suspicious activity in mid-July and confirmed the theft of patient PII and PHI affecting 126,196 people; the Interlock ransomware group claimed responsibility and posted over 700 GB of stolen data on its leak site.
Full text
Healthcare organizations Clover Health Investments and AngMar Management Services are notifying more than 250,000 people that their information was stolen in separate data breaches. Jersey City, New Jersey-based Clover Health Investments was hacked in early July, after attackers used social engineering to compromise three non-managerial health plan employee accounts. The incident resulted in the theft of personally identifiable information (PII) and protected health information (PHI), the company said in an SEC filing in July. The potentially affected information included names, dates of birth, insurance identifiers, and account identification numbers, the company revealed. In mid-September, Clover Health Investments told the US Department of Health and Human Services (HHS) that 138,677 people were affected. HHS added the company to its data breaches portal last week. Mansfield, Texas-based AngMar Management Services identified suspicious activity on its systems in mid-July and confirmed in early September that hackers stole patient PII and PHI.Advertisement. Scroll to continue reading. AngMar Management Services provides business operations, administration, and support network management for home health and hospice care providers. The impacted information includes names, birth dates, Social Security numbers, diagnosis details, medical history data, health insurance information, patient IDs, provider names, prescription details, and dates of service. The Interlock ransomware group added AngMar Management Services to its Tor-based leak site in August, claiming to have stolen over 700 gigabytes of data. On September 16, the company notified HHS that 126,196 individuals were affected. The company was added to HHS’s data breach portal last week. Related: Pentagon Personnel Agency Data Breach Impacts 3 Million People Related: DC Health Agency Exposes 400,000 Beneficiary Records Related: Astrana Health Data Breach Impacts Private, Confidential Information Related: ShinyHunters Claims FBI Hack, Demands Retraction of Threat Report Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire In Rare Move, Alleged Iranian State Hacker Extradited to USWarlock Expands SharePoint Exploitation in Critical Infrastructure AttacksExploited Fortinet FortiMail Zero-Day Calls for Urgent ActionZimbra Vulnerability Exploited in the Wild Prior to Public DisclosureZammad Zero-Days Exploited in AI-Powered DIVD Hack500,000 Active Credentials Left Exposed on GitHubCisco Patches Exploited Catalyst SD-WAN Zero-Day VulnerabilityWatchGuard Patches Critical Fireware OS Code Injection Vulnerability Latest News Linux Backdoor Abuses STUN Protocol, Exploits Dozens of FlawsExploitation Hits Rejetto HFS Vulnerability Discovered by AI Senate Passes Bipartisan Bill to Strengthen Healthcare CybersecurityAlleged ShinyHunters Leader Arrested in JordanExploitation of Citrix NetScaler Zero-Day Hits Appliances Patched Days EarlierTrump Names National Intelligence Director Jay Clayton to Lead a New Federal AI Task Forcedoxx.net Raises $38 Million to Prevent AI Agent-on-the-Internet MisadventuresFortra Patches Critical Vulnerabilities in BoKS Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Securing AI Agents, MCPs, and AI Automations October 7, 2026 Learn how to address potential risks and not restrict AI adoption in your organization. See what a centralized AI gateway is and how it works in practice. Register Virtual Event: Zero Trust & Identity Strategies Summit 2026 October 14, 2026 Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction. Register People on the MoveChip Wentz has been appointed as SVP & CISO at Keurig Dr Pepper Inc.Lumen Technologies has named Kim Keever as CSO.Quantum Secure Encryption Corp. has appointed Joseph Hall as CIO.More People On The MoveExpert Insights AI Has Changed Attack Speed, Not Security Fundamentals As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb) Four Cyber Threats Harboring Big Plans for the Future - AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin) Begin at the End: How to Enable Agentic Remediation Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael) “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) Flipboard Reddit Whatsapp Whatsapp Email