[Ucrea] United Healthcare – Privacy Breach

[Cristina L Otegui]

[cid:image002.png at 01D97D1D.7019C180]
May 2, 2023

To:           UCR Emeriti & Retirees
From:      Central HR Benefits Office on Behalf of the UC Office of the President
Re:          United Healthcare – Privacy Breach

UC Office of the President was notified by United Healthcare (UHC) of a privacy breach that occurred on February 22, 2023. A notification letter of the incident was mailed directly to the five impacted UC Medicare Choice members on or about April 28, 2023, and to provide identity theft protection services for these members at no cost. A sample of this notification letter can be viewed at: https://live-ucr-retirees.pantheonsite.io/document/unitedhealthcare-privacy-issue.

Please note that those UC Medicare Choice members impacted have been contacted directly and that the exposure appears to be limited. The exposure did not involve the disclosure of Social Security or driver’s license numbers. Personal information disclosed may vary and include the following:

·         A combination of first and last name

·         Health insurance member I.D. number

·         Date of birth

·         Address

·         Dates of service

·         Provider name(s),

·         Claim information

·         Group name and number

On February 22, 2023, UnitedHealthcare identified suspicious activity on the UHC mobile application (the “Application”). Through a joint investigation by the Privacy Office, the Security Incident Response team, the Application technology team, and a third-party forensics firm, it was determined that the suspicious activity was the result of a credential stuffing attack on the Application. Impacted member portal accounts were locked to prevent further access and members were forced to reset their passwords upon the next attempted login. They have no evidence that members’ login credentials were accessed or obtained from any UHC system.

For questions or for more information, members may call UHC at 1-800-669-1812, Monday through Friday, from 6:00 a.m. to 3:00 p.m. Pacific Time as indicated on the notification letter.






-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.ucr.edu/pipermail/ucrea/attachments/20230503/a993ccf4/attachment-0001.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: image002.png
Type: image/png
Size: 8019 bytes
Desc: image002.png
URL: <https://lists.ucr.edu/pipermail/ucrea/attachments/20230503/a993ccf4/attachment-0001.png>