Skip to main content
You have permission to edit this article.

Excellus to pay $5 million over data breach that affected 9 million customers

  • Updated

Roger Severino, director of the Office for Civil Rights, poses for a portrait in 2018 at the office of Health and Human Services in Washington.

Federal officials announced Friday that a major health insurer has agreed to a $5 million settlement for failing to protect the private information of more than 9 million people.

According to a news release, Excellus Health Plan, a New York health services corporation that provides health insurance coverage to over 1.5 million people in upstate and western New York, has agreed to pay $5.1 million and implement a corrective action plan to settle potential violations of the Health Insurance Portability and Accountability Act (HIPAA) Privacy and Security Rules related to a breach affecting over 9.3 million people.

The U.S. Department of Health and Human Services said that on Sept. 9, 2015, Excellus filed a breach report stating that cyber-attackers had gained unauthorized access to its information technology systems. The breach reportedly began on or before Dec. 23, 2013, and ended on May 11, 2015, during which time hackers installed malware and conducted reconnaissance activities that ultimately resulted in the impermissible disclosure of the protected health information of more than 9.3 million individuals, including their names, addresses, dates of birth, email addresses, Social Security numbers, bank account information, health plan claims, and clinical treatment information.

An investigation by the Office of Civil Rights at HHS found potential violations of the HIPAA rules including failure to conduct an enterprise-wide risk analysis, and failures to implement risk management, information system activity review, and access controls.

“Hacking continues to be the greatest threat to the privacy and security of individuals’ health information. In this case, a health plan did not stop hackers from roaming inside its health record system undetected for over a year which endangered the privacy of millions of its beneficiaries,” OCR Director Roger Severino said in a statement. “We know that the most dangerous hackers are sophisticated, patient, and persistent. Health care entities need to step up their game to protect the privacy of people’s health information from this growing threat.”

In addition to the monetary settlement, HHS said that Excellus will undertake a corrective action plan that includes two years of monitoring. A copy of the resolution agreement and corrective action plan may be found at


Get local news delivered to your inbox!

* I understand and agree that registration on or use of this site constitutes agreement to its user agreement and privacy policy.

Related to this story

Most Popular

Get up-to-the-minute news sent straight to your device.


News Alerts

Breaking News