Sutherland Healthcare Solutions Data Breach Exposes PHI and PII

Sutherland Healthcare Solutions Inc., a healthcare-focused subsidiary of Sutherland Global, disclosed a data breach involving nearly two years of unauthorized access to health insurance claims data.

The breach was disclosed to the Massachusetts Office of Consumer Affairs and Business Regulation on Nov. 3, 2026. Sutherland Healthcare Solutions began sending written notices to affected individuals on Nov. 2, 2026.

At various points in time between July 29, 2024, and July 10, 2026, an unauthorized individual gained access to claims-related information by acting on behalf of a Sutherland Healthcare Solutions employee. The incident occurred during the course of claims processing work that Sutherland performs on behalf of health insurance companies.

The determination of which specific individuals and types of data were involved was completed on or about Aug. 24, 2026.

The types of personally identifiable information (PII) and protected health information (PHI) exposed included names, addresses, genders, dates of birth, Social Security numbers, health plan member IDs, health plan information, health insurance claims data, healthcare provider names, dates of service and diagnosis, procedure and treatment information.

The exposed records did not include any financial account numbers.

Sutherland Healthcare Solutions' response to the breach

Sutherland Healthcare Solutions arranged for free identity theft protection services through IDX for all affected individuals.

Affected individuals can enroll in these protective services by visiting the IDX enrollment page, by calling 1-866-200-0942 or by scanning the QR code included in their written notification letter. The deadline to enroll is Feb. 2, 2027.

Individuals with general questions about the incident may also reach out to the same phone number. IDX representatives are available Monday through Friday from 9 a.m. to 9 p.m. Eastern Time, excluding U.S. holidays.