Alegeus Data Breach Exposes Social Security Numbers

Waltham, Massachusetts based benefits administration company Alegeus, disclosed a data breach that exposed Social Security numbers.

The breach was disclosed to the Massachusetts Office of Consumer Affairs and Business Regulation, with the filing referencing Health Plans Inc. (HPI) as a partner involved in the consumer notification process.

The notification letter states that the incident "may have affected the privacy of some of your personal health information," according to the notice. The types of consumer information confirmed as exposed include Social Security numbers.

Because Alegeus operates under a white-label model, its technology is embedded within the branded systems of its partner organizations. Those partners include health plans, TPAs, human capital management providers and financial services firms. This means that individuals whose data was affected may not have previously known that Alegeus processed or stored their personal information.

Alegeus's response

According to the notification letter, Alegeus stated that it has taken steps to help protect the information of affected individuals and to better prevent similar incidents from happening in the future. The specific nature of those steps was not detailed in the publicly available version of the notice.

The company apologized in its letter, stating, "We sincerely apologize for any concern or inconvenience this incident may cause. Protecting your information is important to us, and we remain committed to safeguarding the privacy and security of your information."

Health Plans Inc., one of Alegeus's partners, is providing affected individuals with two years of complimentary credit monitoring and identity protection services through IDX. Those who received a notification letter can enroll by visiting the IDX enrollment page and entering the unique enrollment code printed in their letter. Each enrollment code has an expiration date, which is listed in the notification. After enrolling, individuals must activate the credit monitoring feature for it to take effect.

If an affected individual discovers suspicious items on their credit report after enrolling, they can notify IDX by calling or by logging into the IDX website and filing a request for help. According to the notification, individuals who fall victim to identity theft as a result of this incident will be assigned a dedicated ID Care Specialist who will work on their behalf to help identify, stop and reverse the damage.

Alegeus has also set up a dedicated customer service line for people with questions about the breach. The phone number is included in each person's notification letter. The company encouraged affected individuals to remain vigilant, review their account activity carefully and report any suspicious or unfamiliar activity right away.