Benefits Management Group
Disclosed Jan 24, 20251 year ago33,484 affectedConfirmed
The business associate (BA), Benefits Management Group, Inc., reported that it learned of potential unauthorized activity relating to its computer systems that affected the protected health information (PHI) of 33,484 individuals. The PHI involved included clinical, demographic, and financial information. The BA notified HHS and the affected individuals. In response to the breach, the CE and BA provided complimentary credit monitoring services to the affected individuals, implemented additional administrative, technical, and security safeguards, and retrained workforce members to better protect PHI.
What is known
| People affected | 33,484 (as reported to HHS) |
|---|---|
| Disclosed | Jan 24, 2025 |
| Discovered | Apr 15, 2025 |
| Happened | Oct 24, 2024 |
| Attack | Hacking |
| Data exposed | Names, Health |
| Sector | Insurance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: Benefits Management Groupoag.ca.gov · Official notice | Official notice |
| Oregon DOJ breach notice: Benefits Management Groupjustice.oregon.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): Benefits Management Group (Business Associate, IL)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| HHS archivetotal | Jan 24, 2025 | 33,484 |
| California AGresidents of CA | Jul 17, 2025 | |
| Oregon DOJresidents of OR | Jul 17, 2025 | 74,360 |
History of this record
- 2026-09-25 · attack: unknown to hacking · backfill source
- 2026-09-25 · data_types: [] to ["names","health"] · backfill source
- 2026-09-25 · records_basis: empty to hhs · backfill source
- 2026-09-25 · records: empty to 33484 · backfill source
- 2026-09-25 · disclosed: 2025-07-17 to 2025-01-24 · backfill source
- 2026-09-25 · summary: empty to The business associate (BA), Benefits Management Group, Inc., reported that it learned of potential unauthorized activity relating to its computer systems that affected the protected health information (PHI) of 33,484 individuals. The PHI i · backfill source
- 2026-09-25 · discovered: empty to 2025-04-15 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.