New England insurer Point32Health hit with ransomware

A New England health insurance firm serving more than two million people is dealing with a ransomware attack this week impacting several of its systems.

Point32Health – which was built out of the merger of Harvard Pilgrim Health Care and Tufts Health Plan – said it discovered the ransomware on April 17 in systems for “service members, accounts, brokers and providers.”

“After detecting the unauthorized party, and out of an abundance of caution, we proactively took certain systems offline to contain the threat. We have notified law enforcement and regulators, and are working with third-party cybersecurity experts to conduct a thorough investigation into this incident and remediate the situation,” the company said in a statement.

“While we work diligently to restore the impacted systems as quickly and as safely as possible, our team is working around the clock to provide workarounds for members to receive the services they need.”

The company urged members to call a provided phone number for any emergencies. It said it plans to contact any customers who may have had information leaked during the attack.

Point32Health provides services to people across Massachusetts, Maine, Connecticut, New Hampshire, and Rhode Island, including those eligible for Medicare and Medicaid.

The company is the second largest insurer in Massachusetts and the state’s last governor, Charlie Baker, was CEO of Harvard Pilgrim Health Care for a decade.

No ransomware group has come forward to claim the attack. Ransomware incidents involving healthcare organizations have increased precipitously, according to researchers from cyber underwriter Corvus Insurance. An analysis of data from the dark web and ransomware leak sites showed that hospitals and healthcare organizations experienced a 750% increase in attacks between February and March 2023.

Several insurance companies have faced attacks in recent months, including Lloyd’s of London, Aflac and Zurich.

Correction: An earlier version of this article misstated when Corvus Insurance researchers saw a 750% increase in attacks year-over-year. It was February and March 2023, not year-over-year.