Connecticut Attorney General Richard Blumenthal said Wednesday that health insurer Health Net lost financial, health and personal information of nearly 450,000 state residents and failed to inform consumers for six months.
Health Net spokeswoman Alice Ferreira said an unencrypted portable disk drive was discovered missing from the company's Shelton office. She said in an interview that it took the company six months to determine who was affected and it notified Blumenthal Wednesday.
When the company discovered the missing information in May, it immediately employed forensic experts to "piece together" what had happened, she said.
Information was saved in an image format that could not be read without special software, but contained personal information of many past and present members, Ferreira said.
Blumenthal said the company informed his office Wednesday that the records of about 446,000 residents are involved, which Ferreira confirmed.
Blumenthal said he is "outraged and appalled" by the loss of the information and the insurer's failure to quickly inform authorities and consumers. He said he is investigating a possible violation of state law that requires companies to inform consumers and state officials of data breaches "without unreasonable delay."
Whether the notification six months after the discovery was unreasonable will be part of the attorney general's investigation, he said.
Health Net said it will provide free credit monitoring for more than two years to members affected by the missing data and who choose the monitoring. The insurer also said it will provide assistance to any member who has noticed suspicious activity, identity theft or health care fraud between May 2009 and their date of enrollment with the identity protection service.
