250,000 Impacted by Data Breaches at New Jersey, Texas Healthcare Firms
250,000 patients affected by separate July breaches at Clover Health and AngMar Management Services.
Clover Health Investments (New Jersey) and AngMar Management Services (Texas) reported separate data breaches affecting over 250,000 patients combined. Clover Health was compromised in early July via social engineering targeting three employee accounts, exposing names, dates of birth, insurance identifiers, and account numbers from 138,677 individuals. AngMar Management Services discovered suspicious activity in mid-July and confirmed the theft of patient PII and PHI affecting 126,196 people; the Interlock ransomware group claimed responsibility and posted over 700 GB of stolen data on its leak site.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Clover Health Investments?
Get an email when a new story names Clover Health Investments, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonTwo separate healthcare breaches affecting over 250,000 individuals highlight persistent vulnerabilities in employee account security and data protection practices. Clover Health fell victim to social engineering that compromised three employee accounts, demonstrating that human manipulation remains one of the most effective attack vectors. AngMar Management Services suffered a ransomware attack by the Interlock group, resulting in over 700 GB of sensitive PHI being publicly leaked. These incidents underscore the critical importance of healthcare organizations investing in both technical controls and human-layer defenses, as attackers frequently exploit the weakest link — people — to gain initial access before exfiltrating or encrypting sensitive data.
What helps against this
How we list vendors- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Immutable backup and recovery
Ransomware cannot delete or encrypt your way back.