WebTPA Employer Services
Disclosed May 8, 20242 years ago2,518,533 affectedConfirmed
Health plan administrator WebTPA breach affects almost 2.5 million people
WebTPA said it detected suspicious activity on December 28, 2023 and found an unauthorized actor may have obtained personal information between April 18 and 23, 2023; TechCrunch reported almost 2.5 million people were affected, some with Social Security numbers.
What is known
| People affected | 2,518,533 (as reported to HHS) |
|---|---|
| Disclosed | May 8, 2024 |
| Discovered | Dec 28, 2023 |
| Happened | Apr 18, 2023 |
| Attack | Hacking |
| Data exposed | Names, Social Security numbers, Health |
| Sector | Insurance · US |
| Status | Confirmed |
Sources
| Source | |
|---|---|
| California Attorney General breach notice: WebTPA Employer Servicesoag.ca.gov · Official notice | Official notice |
| California AG: WebTPA Employer Services breach noticeoag.ca.gov · Regulator | Regulator |
| Healthcare company WebTPA discloses breach affecting 2.5 million peopletechcrunch.com · News | News |
| Indiana Attorney General 2024 data breach report: WebTPA Employer Servicesin.gov · Official notice | Official notice |
| HHS OCR breach report (archive, resolved): WebTPA Employer Services (Business Associate, TX)ocrportal.hhs.gov · Official notice | Official notice |
Notices filed
| Where | Filed | People |
|---|---|---|
| California AGresidents of CA | May 8, 2024 | |
| Researchtotal | May 8, 2024 | |
| Indiana AGresidents of IN | May 8, 2024 | 20,085 |
| HHS archivetotal | May 8, 2024 | 2,518,533 |
| California AGresidents of CA | Jul 19, 2024 |
History of this record
- 2026-09-25 · data_types: ["names","ssn"] to ["names","ssn","health"] · backfill source
- 2026-09-25 · records_basis: organization to hhs · backfill source
- 2026-09-25 · records: 2429175 to 2518533 · backfill source
- 2026-09-25 · records_basis: empty to organization · backfill source
- 2026-09-25 · records: empty to 2429175 · backfill source
- 2026-09-25 · sector: other to insurance · seed source
- 2026-09-25 · attack: unknown to hacking · seed source
- 2026-09-25 · data_types: [] to ["names","ssn"] · seed source
- 2026-09-25 · discovered: empty to 2023-12-28 · seed source
- 2026-09-25 · summary: empty to WebTPA said it detected suspicious activity on December 28, 2023 and found an unauthorized actor may have obtained personal information between April 18 and 23, 2023; TechCrunch reported almost 2.5 million people were affected, some with So · seed source
- 2026-09-25 · title: empty to Health plan administrator WebTPA breach affects almost 2.5 million people · seed source
- 2026-09-25 · disclosed: 2024-07-19 to 2024-05-08 · backfill source
- 2026-09-25 · added · backfill source
First seen 2026-09-25 (California AG), confirmed by California AG. Record counts are as reported. Not legal advice.