1. News
  2. Alerts
  3. Health · Data breach
AlertHealth · Data breach2 min read

41,000 Connecticut Medicaid Patients Had Billing Details Exposed

A hacker got into a Connecticut Medicaid payment account, exposing billing and insurance details for about 41,000 people. Social Security numbers were not included.

By the Dashline deskSource: HIPAA Journal
41,000 Connecticut Medicaid Patients Had Billing Details Exposed
Photo: Tdorante10, CC BY-SA 4.0
Act this week
What happenedAn unauthorized user got into a Connecticut Medicaid provider reimbursement account, exposing claims and payment information for about 41,000 people.
Who is affectedPeople enrolled in Connecticut's Medicaid program (HUSKY), plus patients of a few other health providers named in separate breaches, including a New York home care program and two eye clinics.
What to do
  1. 1Read your notification letter and accept the free credit monitoring and identity theft protection offer.
  2. 2Check your health insurance statements for services or payments you do not recognize.
  3. 3Be wary of calls, texts or emails that mention your health care or insurance, since scammers may use these details.
  4. 4Report anything suspicious to your insurer or the state agency right away.

Connecticut says someone broke into a Medicaid provider payment account and saw billing records for about 41,000 people. The state Department of Social Services (DSS) reported it. The records cover HUSKY, the state's Medicaid program. Social Security numbers were not part of it, but the details that were exposed can still help scammers.

What happened

An unauthorized user got into a Medicaid provider reimbursement account. That is the kind of account used to handle payments to health care providers. Gainwell Technologies, which administers the account for the state, told DSS about the breach on June 25, 2026.

The investigation found the access was most likely driven by money, not by an interest in patient data. Even so, investigators could not rule out that data was stolen. The provider portal has since been secured.

What was exposed

  • Names and identification numbers tied to claims or provider payment accounts
  • Dates of service and the services received
  • Payment information and amounts paid
  • Details about any non-Medicaid health insurance

Who can relax a little

DSS says electronic medical records, financial information and Social Security numbers were not involved. That lowers the risk of someone opening new accounts in your name. It does not remove the risk of fake claims or convincing scam messages that mention your care.

A second breach this year

This is the second HUSKY incident announced in 2026. In March, about 22,500 people were affected when someone used the stolen login of a Hartford Healthcare employee to get into the system.

Other health breaches were announced at the same time. Public Partnerships LLC, which runs New York's home care program CDPAP, said a former facilitator tried to sell data on 12,018 people. The sale appears not to have gone ahead. Hattiesburg Eye Clinic in Mississippi reported 6,137 people affected, and the Eye Care Center of Snohomish in Washington reported 3,059.

What to do

The alert box above lists the steps. In short, read your notification letter, take the free credit monitoring offer, and check your insurance statements. Treat any call, text or email about your health care with suspicion, even if it seems to know details about you.

What happens next

Affected people have been offered free credit monitoring and identity theft protection. The material does not say whether any of the stolen data has been misused. If you or a relative use Medicaid, keep watching statements and mail for charges or services you never received.

The takeaway

If you or a relative use Connecticut Medicaid, check your statements for services you did not receive and treat messages about your care with caution.

More articles

You should really read these.

Next step

Let’s talk