Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

6/14/2018
12:49 PM
50%
50%

23,000 Compromised in HealthEquity Data Breach

HealthEquity, which handles more than 3.4 million health savings accounts, was breached when an intruder accessed an employee's email.

Sometimes all it takes is one employee to spark a cybersecurity wildfire, as HealthEquity learned this week. The company, which handles more than 3.4 million health savings accounts, suffered a data breach when an unauthorized person accessed an employee's email account.

The incident took place on April 11 and was discovered two days later. When the company learned an employee's email was compromised, it removed access to the mailbox and hired a forensics firm to confirm the breach did not affect other HealthEquity systems.

HealthEquity manages flexible spending accounts, 401(k) accounts, health reimbursement, and other services for about 40,000 companies, Health Data Management reports. The breach affected two Michigan-based companies, both of which work with HealthEquity and have been offered five years of credit monitoring and identity theft protective services.

Data affected in the breach includes employee names, employer names, employee and employer HealthEquity IDs, different types of healthcare accounts, deduction amounts, and for some workers, their Social Security Numbers.

Read more details here.

 

Top industry experts will offer a range of information and insight on who the bad guys are – and why they might be targeting your enterprise. Click for more information

Dark Reading's Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
CameronRobertson
50%
50%
CameronRobertson,
User Rank: Moderator
12/22/2018 | 4:48:32 AM
Company's responsibility
Something that I have always thought about - is that when it comes to workplace security, isn't the responsibility in the hands of the company itself to ensure that all systems and hardware are properly secured? Unless it has been determined that the employee has purposefully given away information or allowed access, I believe that the fault is entirely in the company's failure to be more protected to begin with!
michaelmaloney
50%
50%
michaelmaloney,
User Rank: Apprentice
12/18/2018 | 10:32:16 PM
Do not store
This is the reason why some patients make special requests for their medical info not to be stored by the medical institutions. At times, we think that they are obstructing their operation, but it is the fear of breaches happening. Not everyone is comfortable with their medical records falling into the wrong hands, especially people of name.
97% of Americans Can't Ace a Basic Security Test
Steve Zurier, Contributing Writer,  5/20/2019
How Security Vendors Can Address the Cybersecurity Talent Shortage
Rob Rashotte, VP of Global Training and Technical Field Enablement at Fortinet,  5/24/2019
TeamViewer Admits Breach from 2016
Dark Reading Staff 5/20/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Building and Managing an IT Security Operations Program
As cyber threats grow, many organizations are building security operations centers (SOCs) to improve their defenses. In this Tech Digest you will learn tips on how to get the most out of a SOC in your organization - and what to do if you can't afford to build one.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-7068
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7069
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have a type confusion vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7070
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .
CVE-2019-7071
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an out-of-bounds read vulnerability. Successful exploitation could lead to information disclosure.
CVE-2019-7072
PUBLISHED: 2019-05-24
Adobe Acrobat and Reader versions 2019.010.20069 and earlier, 2019.010.20069 and earlier, 2017.011.30113 and earlier version, and 2015.006.30464 and earlier have an use after free vulnerability. Successful exploitation could lead to arbitrary code execution .