Community Health Plan of Washington
Disclosed Dec 21, 20169 years ago381,504 affectedConfirmed
Vendor's unsecured FTP server exposes data of 381,504 health plan members
Business associate Transactions Application Group failed to secure a port on an FTP server, allowing unauthorized access to names, addresses, birth dates, Social Security numbers and claims codes of 381,504 plan members.
What is known
| People affected | 381,504 (as reported by the organization) |
|---|---|
| Disclosed | Dec 21, 2016 |
| Discovered | Nov 30, 2016 |
| Happened | Jan 16, 2016 |
| Attack | Vendor breach |
| Data exposed | Names, Addresses, Dates of birth, Social Security numbers, Health |
| Sector | Insurance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| Washington Attorney General breach notice: Community Health Plan of Washingtonatg.wa.gov · Official notice | Official notice |
| HHS Office for Civil Rights breach portal (archive): Breaches Affecting 500 or More Individualsocrportal.hhs.gov · Regulator | Regulator |
| Maine Attorney General breach notice archive: Community Health Plan of Washingtonmaine.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| Washington AGresidents of WA | Dec 21, 2016 | 353,388 |
| Researchtotal | Dec 21, 2016 | 381,504 |
| HHS archivetotal | Dec 21, 2016 | 381,504 |
| Maine AGresidents of ME | Dec 29, 2016 | 2 |
| HHS archivetotal | Jan 3, 2017 | 1,375 |
History of this record
- 2026-09-25 · source: empty to https://www.maine.gov/ag/sites/maine.gov.ag/files/docs/Data%20breach%20spreadsheet%208-1-2021%20through%2012-5-2018%20REDACTED.xlsx · backfill source
- 2026-09-25 · sector: health to insurance · seed source
- 2026-09-25 · attack: hacking to third-party · seed source
- 2026-09-25 · data_types: [] to ["names","addresses","dob","ssn","health"] · seed source
- 2026-09-25 · records_basis: empty to organization · seed source
- 2026-09-25 · records: empty to 381504 · seed source
- 2026-09-25 · summary: empty to Business associate Transactions Application Group failed to secure a port on an FTP server, allowing unauthorized access to names, addresses, birth dates, Social Security numbers and claims codes of 381,504 plan members. · seed source
- 2026-09-25 · title: empty to Vendor's unsecured FTP server exposes data of 381,504 health plan members · seed source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (Washington AG), confirmed by Washington AG. Record counts are as reported. Not legal advice.