Data breach affects thousands

Nearly 450,000 Connecticut residents have had their personal information compromised by a massive data breach at the insurance company Health Net Inc., Attorney General Richard Blumenthal said Wednesday.

Blumenthal said Health Net of Connecticut's Shelton operation lost the information from a hard drive in May but didn't alert authorities until Wednesday. The hard drive contained health information, Social Security and bank account numbers, as well as financial and personal data going back seven years.

Because the data were compressed, the information could be read only by people with special software, according to authorities. Blumenthal, nevertheless, questioned why the data were not encrypted, which offers additional protection from theft.

"I am outraged and appalled by Health Net's huge loss of personal financial and medical information and its failure to swiftly inform authorities and consumers," Blumenthal said in a statement. "Another day, another data breach, but companies still don't get it: Personal information is like cash and should be guarded with equal care."

California-based Health Net's main markets in Connecticut are Fairfield and New Haven counties, but officials said many southeastern Connecticut residents will likely be affected by the data breach as well. That's because Health Net is one of the options for state employee health insurance, and the company also used to participate in the Medicaid program.

Blumenthal said he would be investigating how the data breach happened and why consumers were not informed about it for six months. He said the failure to safeguard personal information can be a violation of state and federal laws.

State authorities said they will demand that Health Net provide two years of identity theft protection and reimbursements for credit freezes to help 446,000 Connecticut consumers protect their financial assets.

"We are currently working with Health Net to ensure adequate notification and protections for all involved," added state Insurance Commissioner Thomas R. Sullivan. "My office is committed to a thorough review of this situation, and will determine next steps and appropriate enforcement action."

l.howard@theday.com