A security breach at a managed care services provider in Puerto Rico could have exposed the personal information of more than 400,000 customers, according to a breach disclosure sent this week by the Puerto Rico Department of Health to the U.S. Department of Health and Human Services.

According to a report from Databreaches.net, the breach occurred on Sept. 21 at Triple-S Management, a Puerto Rico managed care company, and Triple-S Salud, an independent licensee of the Blue Cross and Blue Shield Association for Puerto Rico.

According to the disclosure, one or more employees of Puerto Rico's Medical Card System illegally accessed restricted areas of the organization's website until Sept. 30. The breach affected people enrolled in the health plan of the Puerto Rican government for the North and North Metro regions. The violation involved a variety of customer data, including subscriber names, addresses, diagnostic codes, procedure codes, and independent practice associations (IPAs).

A statement in Triple-S Management's Form 10-Q offered more information. "Our investigation has revealed that the security breaches were the result of unauthorized use of one or more active user IDs and passwords specific to the TCI IPA database, and not the result of breaches of TSS's or the corporation's system security features," the statement says. "We cannot at this time determine the purpose of these breaches and do not know the extent of any fraudulent use of the information or its impact on the potentially affected individuals and IPAs."

TSS says it has notified law enforcement and the appropriate agencies, but it also said the Puerto Rican government has levied a $100,000 fine on the company, which is currently under appeal.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.