No hospital server was touched. An intruder got into a billing vendor’s portal account instead, taking the claims records of 41,000 people on Connecticut’s HUSKY Medicaid program.
The Connecticut Department of Social Services learned on June 25 from Gainwell Technologies, its fiscal agent, that an unauthorized user had gotten into a Medicaid provider reimbursement account. What followed was claims and payment data: names, claim IDs, dates of service, payment amounts, service details and non-Medicaid insurance information. Medical records, Social Security numbers and financial accounts were untouched. Officials judged the access most likely financially motivated; the portal has since been hardened.
The same door, twice in one year
It is Connecticut’s second such incident this year. In March about 22,500 people were caught up in a HUSKY portal breach traced to credentials belonging to a Hartford HealthCare employee. Both cases turned on a portal that trusts a login rather than a device, and neither required malware.
Gainwell runs fiscal agent portals for Medicaid programs in several states, which makes the pattern a national one. Kentucky’s program was hit through the same class of provider-facing portal earlier in 2026, its third such incident.
Where provider portals leak
Reimbursement portals are built for volume, not verification. They frequently accept legacy credentials with no multifactor requirement, keep sessions alive for days and allow bulk claim exports that look identical to routine billing work. A stolen login therefore produces a quiet data pull that blends into normal traffic.
Medicaid programs and contractors should require phishing-resistant multifactor on every provider account, alert on bulk exports beyond a provider’s usual volume, and expire dormant accounts. For a clinic the advice runs the other way too: a shared billing login is an entry point into a state program’s claims data, and the fallout lands well beyond the practice.
