Act this weekWhat happenedAn unauthorized user got into a Connecticut Medicaid provider reimbursement account, exposing claims and payment information for about 41,000 people.
Who is affectedPeople enrolled in Connecticut's Medicaid program (HUSKY), plus patients of a few other health providers named in separate breaches, including a New York home care program and two eye clinics.
What to do- 1Read your notification letter and accept the free credit monitoring and identity theft protection offer.
- 2Check your health insurance statements for services or payments you do not recognize.
- 3Be wary of calls, texts or emails that mention your health care or insurance, since scammers may use these details.
- 4Report anything suspicious to your insurer or the state agency right away.
Connecticut says someone broke into a Medicaid provider payment account and saw billing records for about 41,000 people. The state Department of Social Services (DSS) reported it. The records cover HUSKY, the state's Medicaid program. Social Security numbers were not part of it, but the details that were exposed can still help scammers.
What happened
An unauthorized user got into a Medicaid provider reimbursement account. That is the kind of account used to handle payments to health care providers. Gainwell Technologies, which administers the account for the state, told DSS about the breach on June 25, 2026.
The investigation found the access was most likely driven by money, not by an interest in patient data. Even so, investigators could not rule out that data was stolen. The provider portal has since been secured.
What was exposed
- Names and identification numbers tied to claims or provider payment accounts
- Dates of service and the services received
- Payment information and amounts paid
- Details about any non-Medicaid health insurance
Who can relax a little
DSS says electronic medical records, financial information and Social Security numbers were not involved. That lowers the risk of someone opening new accounts in your name. It does not remove the risk of fake claims or convincing scam messages that mention your care.
A second breach this year
This is the second HUSKY incident announced in 2026. In March, about 22,500 people were affected when someone used the stolen login of a Hartford Healthcare employee to get into the system.
Other health breaches were announced at the same time. Public Partnerships LLC, which runs New York's home care program CDPAP, said a former facilitator tried to sell data on 12,018 people. The sale appears not to have gone ahead. Hattiesburg Eye Clinic in Mississippi reported 6,137 people affected, and the Eye Care Center of Snohomish in Washington reported 3,059.
What to do
The alert box above lists the steps. In short, read your notification letter, take the free credit monitoring offer, and check your insurance statements. Treat any call, text or email about your health care with suspicion, even if it seems to know details about you.
What happens next
Affected people have been offered free credit monitoring and identity theft protection. The material does not say whether any of the stolen data has been misused. If you or a relative use Medicaid, keep watching statements and mail for charges or services you never received.
The takeawayIf you or a relative use Connecticut Medicaid, check your statements for services you did not receive and treat messages about your care with caution.