UnitedHealthcare Student Resources, which provides health insurance to college and university students, announced Friday that it is reporting a data security incident that involves the personal information of certain Virginia residents.
On May 31, Progress Software, announced it discovered a previously unknown (“zero-day”) vulnerability in MOVEit Transfer software (“MOVEit”) that could allow an unauthorized third party to access files sent with the software.
Upon learning of the vulnerability, Student Resources immediately began investigating any potential impact and took immediate action to secure its systems.
Through its investigation, Student Resources determined that an unauthorized third party was able to access certain systems and remove copies of some personal information from its MOVEit server on May 27.
While the information contained on the MOVEit server varied by individual, it may have included a combination of names, date of births, addresses, phone numbers, email addresses, plan identification numbers, policy information, student identification numbers, claims information, including claim numbers, provider information, dates of service, diagnosis codes, prescription information, and claims financial information. For a subset of the impacted population, the information involved also contained Social Security numbers or national identification numbers.
This incident did not involve the disclosure of driver’s license numbers or any financial account information.
Not all data elements were involved for all individuals, according to Student Resources.
The company says it has put in place additional safeguards to further bolster its security to help prevent similar incidents from occurring in the future.
Affected individuals are being notified and will be offered complimentary credit monitoring and identity protection services.
Although the company is unaware of any misuse of the information, as a precaution, it advises those affected to order a credit report and regularly monitor their health care and other statements for any unfamiliar activity.
Any suspicious activity should immediately be reported to their health plan or other relevant institution.
Also, a toll-free hotline has been established to help answer any questions and can be reached at 1-866-341-4262 from Monday through Friday between 7 a.m. – 7 p.m. CST.
