In the wake of a cybersecurity breach discovered in December 2024, Kelly & Associates Insurance Group, also known as Kelly Benefits, has seen a significant increase in the number of individuals affected. Initially reporting 32,234 victims, the company revealed in a recent update that the figure has surged to 413,032. This comes after an earlier update in April, which listed 263,893 individuals affected. The breach, which involved unauthorized access to the company’s IT environment between December 12 and December 17, 2024, compromised various types of sensitive information, including names, Social Security numbers, dates of birth, and health-related data.
As the investigation unfolds, Kelly Benefits has expanded the list of affected clients. Initially, nine companies were reported, but the latest disclosure adds approximately a dozen more, encompassing notable firms such as Aetna Life Insurance Co., Humana Insurance, and United Healthcare Services. The company has indicated that the breach details might continue to evolve as new information comes to light. Despite requests, Kelly Benefits has yet to provide further comments on the newly affected clients and the expanding number of compromised individuals.
The repercussions of the data breach extend beyond the growing victim count. Kelly Benefits is currently facing at least 13 proposed federal class action lawsuits. The situation underscores a broader trend in the healthcare sector, where a significant percentage of data breaches involve third-party entities. According to the latest Verizon Data Breach Investigations Report, the incidence of third-party breaches across various sectors has doubled compared to the previous year, with healthcare being particularly vulnerable.
Regulatory attorney Paul Hales highlights the unique position of Kelly Benefits as a HIPAA business associate that acts as a third-party administrator. These entities are crucial in connecting employer-sponsored health plans with employees and insurers, handling protected health information (PHI) extensively. The inherent risk comes from their extensive communication networks, which can be susceptible to breaches through simple means like phishing emails. The complexity and scale of these networks pose challenges in promptly identifying the scope of breaches.
The breach at Kelly Benefits is a stark reminder of the vulnerabilities present within third-party healthcare service providers. As the industry grapples with increasing cybersecurity threats, the necessity for robust security measures and vigilant monitoring becomes ever more critical to safeguard sensitive health information and maintain trust in these essential services.