90 Degree Benefits, Inc.

# Healthcare Data Breach Report: 90 Degree Benefits, Inc. ## Opening Summary On February 8, 2023, 90 Degree Benefits, Inc., a Wisconsin-based healthcare benefits administration company, reported a significant data breach affecting approximately 175,000 individuals. The breach resulted from unauthorized access to the company's network server infrastructure, compromising protected health information (PHI) and personally identifiable information (PII) of current and former plan members. This incident represents a substantial security failure at a business associate level, meaning the organization processes sensitive health data on behalf of covered entities such as health plans and employers. ## Company Response and Investigation Timeline 90 Degree Benefits discovered the unauthorized access to its network server during routine security monitoring or incident response procedures. Upon discovery, the company initiated a comprehensive investigation to determine the scope of the breach, identify affected individuals, and assess what categories of personal information had been compromised. The organization notified affected individuals in accordance with HIPAA Breach Notification Rule requirements, which mandate notification without unreasonable delay and no later than 60 calendar days following discovery of a breach. The submission date of February 8, 2023, indicates the company reported this incident to state authorities within the required timeframe. The investigation likely involved forensic analysis of network logs, access controls, and system vulnerabilities to determine how the unauthorized access occurred and what data was exposed. ## Breach Mechanics and Technical Details The breach occurred at the network server level, which typically indicates that attackers gained unauthorized access to centralized data storage systems where PHI and PII are maintained. Network server compromises often result from vulnerabilities such as unpatched software, weak authentication credentials, misconfigured firewalls, or exploitation of known security weaknesses. The scale of this incident—affecting 175,000 individuals—suggests the attackers accessed a significant portion of the company's database infrastructure rather than isolated records. Hacking incidents at this scale typically involve either sophisticated threat actors targeting healthcare data for financial gain or opportunistic attackers exploiting publicly disclosed vulnerabilities. The fact that this is classified as a hacking/IT incident rather than a loss or theft suggests the breach was discovered through digital forensics rather than physical theft of devices or documents. ## Organizational Context and Operations 90 Degree Benefits, Inc. operates as a benefits administration and consulting firm based in Wisconsin. The company provides services related to employee benefits management, benefits counseling, and health plan administration for employers and health plans across multiple states. As a business associate under HIPAA, the organization is contractually obligated to implement administrative, physical, and technical safeguards to protect PHI. The company's role in the healthcare ecosystem places it in a critical position handling sensitive information for thousands of employers and their employees. The breach of a business associate's systems is particularly concerning because it may affect multiple covered entities and their beneficiaries simultaneously, creating a cascading impact across the healthcare industry. ## Impact on Affected Individuals Approximately 175,000 individuals had their personal and health information potentially compromised in this breach. Affected parties likely include current and former employees of companies that utilize 90 Degree Benefits' services, as well as their family members covered under employer-sponsored health plans. The notification process required the company to contact each affected individual with details about the breach, the types of information exposed, and recommended protective measures. Given the scale of this incident, notifications were likely distributed through multiple channels including direct mail, email, and potentially a dedicated breach notification website. The 175,000 affected individuals represent a significant population across Wisconsin and potentially other states where the company operates. ## Data Exposure and Information Types While the specific data elements exposed were not detailed in the breach submission, network server compromises at benefits administration companies typically expose multiple categories of sensitive information. Likely exposed data may include: names, Social Security numbers, dates of birth, addresses, phone numbers, email addresses, health insurance policy numbers, employer information, health plan details, claims history, medical diagnoses, treatment information, prescription data, and potentially financial account information used for benefits payments. The exposure of Social Security numbers combined with health information creates significant identity theft and fraud risks. The breadth of information typically stored on centralized network servers means that attackers likely obtained comprehensive personal profiles of affected individuals. ## HIPAA Compliance and Regulatory Context This breach triggers multiple HIPAA requirements for both 90 Degree Benefits and any covered entities with which it contracts. Under the HIPAA Breach Notification Rule, the company must notify affected individuals, the media (if more than 500 residents of a state are affected), and the U.S. Department of Health and Human Services (HHS). The breach also requires investigation into whether the company maintained adequate administrative, physical, and technical safeguards as required by the HIPAA Security Rule. Network server breaches of this magnitude often indicate deficiencies in access controls, encryption, vulnerability management, or incident response procedures. Healthcare data breaches involving network infrastructure compromises have become increasingly common, with attackers specifically targeting healthcare organizations due to the high value of health information on the dark web and the critical nature of healthcare operations that may incentivize ransom payments.

# Healthcare Data Breach Report: 90 Degree Benefits, Inc. ## Opening Summary 90 Degree Benefits, Inc., a Wisconsin-based healthcare benefits administration company, experienced a significant data breach involving unauthorized access to its network server infrastructure. The breach was discovered and reported to the U.S. Department of Health and Human Services on June 9, 2022, affecting approximately 172,450 individuals. The incident involved a hacking or IT-related intrusion into the company's network systems, which likely resulted in the exposure of protected health information (PHI) and personally identifiable information (PII) maintained by the organization. As a business associate to covered entities under HIPAA, 90 Degree Benefits was obligated to maintain strict security protocols and notify affected individuals of the breach. ## Company Response and Investigation Timeline Upon discovery of the unauthorized access to its network server, 90 Degree Benefits initiated an incident response protocol consistent with HIPAA breach notification requirements. The company conducted a forensic investigation to determine the scope of the breach, identify which data elements were accessed, and establish the timeline of the intrusion. The submission date of June 9, 2022, indicates that the organization completed its preliminary investigation and determined that notification to affected individuals was required under 45 CFR §164.404. The company worked with its covered entity clients and likely engaged cybersecurity forensics specialists to assess the extent of the compromise and implement remedial measures to prevent future incidents. Standard response procedures for network server breaches typically include system isolation, log analysis, access control reviews, and implementation of additional security controls. ## Technical Details of the Network Server Breach Network server breaches represent a significant category of healthcare data incidents, typically involving unauthorized access through compromised credentials, unpatched vulnerabilities, or targeted cyberattacks. When a network server is compromised, threat actors may gain access to centralized repositories of patient data, claims information, and administrative records. The location designation of "Network Server" suggests that the breach involved backend infrastructure rather than endpoint devices or portable media. This type of incident typically indicates either a remote attack vector (such as exploitation of web-facing applications, VPN vulnerabilities, or phishing-based credential compromise) or potentially an insider threat with network access. Network server breaches often go undetected for extended periods, as attackers may maintain persistent access while exfiltrating data gradually. The investigation likely involved analysis of network logs, access controls, and system configurations to determine how the unauthorized access occurred and what data was accessed during the compromise period. ## Organizational Context and Operations 90 Degree Benefits, Inc. operates as a healthcare benefits administration and management company based in Wisconsin. The organization functions as a business associate under HIPAA, meaning it processes, stores, and manages protected health information on behalf of covered entities such as health plans, employers, and healthcare providers. The company's operations typically include benefits enrollment, claims processing, eligibility verification, and benefits counseling services. With 172,450 individuals affected by this breach, the organization clearly maintains substantial volumes of healthcare data across multiple client relationships. The company's regional presence in Wisconsin and multi-state operations suggest it serves as a significant intermediary in the healthcare benefits ecosystem, handling sensitive information for numerous covered entities and their beneficiaries. ## Impact on Affected Individuals Approximately 172,450 individuals had their personal and health information potentially exposed through the network server breach. This substantial number of affected persons places the incident in the regional to national significance category. Individuals affected by this breach likely included employees, retirees, and dependents covered under various health benefit plans administered by 90 Degree Benefits. The notification process, required under HIPAA's Breach Notification Rule, would have been initiated following the company's determination that a breach of unsecured PHI had occurred. Notifications typically include information about the breach, the types of data exposed, steps individuals should take to protect themselves, and contact information for the organization's breach response team. The affected individuals would have received written notice either directly from 90 Degree Benefits or through their employer or health plan, depending on the contractual relationships and notification responsibilities established in business associate agreements. ## Data Security and HIPAA Compliance Implications As a HIPAA business associate, 90 Degree Benefits was required to maintain administrative, physical, and technical safeguards to protect electronic protected health information (ePHI) in accordance with the HIPAA Security Rule (45 CFR §§164.308-164.318). Network server breaches of this magnitude suggest potential gaps in one or more safeguard categories: access controls may have been insufficient, encryption of data in transit or at rest may have been inadequate, or vulnerability management and patch management processes may have been deficient. The breach notification requirement under 45 CFR §164.404 mandates that covered entities and business associates notify affected individuals without unreasonable delay and in no case later than 60 calendar days after discovery of a breach of unsecured PHI. The June 9, 2022 submission date represents the organization's compliance with HHS notification requirements. Network server breaches affecting over 100,000 individuals are reportable to major media outlets and the HHS Secretary, elevating the public health significance of this incident. The breach underscores the ongoing challenge healthcare organizations face in defending against sophisticated cyber threats targeting valuable healthcare data repositories.