250,000 Patients Hit by Data Breaches in New Jersey and Texas

Scope of the Breaches

In July, two separate cyber incidents compromised the records of roughly 250,000 individuals. One breach targeted Clover Health Investments, a managed‑care organization operating in New Jersey, while the second affected AngMar Management Services, a provider of health‑related services in Texas. Both attacks were attributed to external threat actors who gained unauthorized access to patient databases.

Geographic Impact

The incidents spanned two states with distinct regulatory environments. New Jersey follows the state data breach notification law that requires rapid disclosure to affected residents, while Texas enforces its own statutes under the Texas Business and Commerce Code. The dual‑state nature of the attacks highlights the need for consistent security practices across regional boundaries.

What Information Was Compromised

Investigations revealed that the stolen data included names, dates of birth, Social Security numbers, insurance identifiers, and limited clinical details. No payment card information or full medical histories were reported, but the combination of identifiers is sufficient for identity theft and fraud.

• Patient names and contact information
• Dates of birth and Social Security numbers
• Insurance policy numbers and member IDs
• Limited diagnosis codes and treatment dates

Because the data set contained both personal and health‑related identifiers, it falls under the definition of protected health information (PHI) under the Health Insurance Portability and Accountability Act (HIPAA).

Response from Affected Companies

Both organizations issued public statements within days of discovery. Clover Health pledged to engage a third‑party forensic firm to assess the breach, offered free credit monitoring to affected individuals, and notified the HHS breach notification portal. AngMar Management Services followed a similar path, coordinating with law enforcement and providing identity theft protection services.

In addition to remediation steps, each firm reported the incidents to the respective state health departments, complying with local breach notification timelines.

Regulatory Implications

HIPAA requires covered entities to report breaches affecting 500 or more individuals to the Department of Health and Human Services within 60 days. While the combined total exceeds that threshold, each breach individually involved fewer than 500 records, creating a reporting nuance that regulators must address.

State authorities in New Jersey and Texas have begun reviewing the incidents for potential violations of state privacy statutes. The New Jersey Department of Health and Texas Health and Human Services have both issued advisories urging healthcare providers to reassess their security controls.

National Trends

The breaches align with findings from the Verizon Data Breach Investigations Report, which notes that healthcare remains a top target for ransomware and credential‑theft attacks. The report emphasizes that phishing, weak password policies, and unpatched systems are common entry points.

Best Practices for Healthcare Organizations

Industry experts recommend a layered security approach to protect PHI. Key measures include:

1. Implementing multi‑factor authentication for all privileged accounts.
2. Conducting regular vulnerability scans and applying patches promptly.
3. Providing ongoing security awareness training to staff, with a focus on phishing detection.
4. Encrypting data at rest and in transit to reduce exposure if a breach occurs.
5. Maintaining an incident response plan that outlines roles, communication protocols, and recovery steps.

Adopting these practices can reduce the likelihood of successful intrusion and limit the impact of any future compromise.

Industry Reaction

Commentators have called the twin breaches a wake‑up call for the broader health sector. A recent article in SecurityWeek highlighted the growing sophistication of threat actors targeting smaller providers that may lack robust security budgets.

Analysts suggest that as electronic health records become more integrated, the attack surface expands, making coordinated defense strategies essential.

Looking Ahead

Regulators are expected to tighten oversight of data protection practices, especially as state‑level privacy laws such as the New Jersey Data Privacy Act and the Texas Identity Theft Enforcement and Protection Act gain traction. Healthcare entities that proactively adopt stronger safeguards may avoid costly penalties and preserve patient trust.

Patients affected by the breaches are encouraged to monitor credit reports, enroll in identity theft protection services offered by the firms, and stay alert for suspicious communications.