Medicaid Members Offered Free Identity Monitoring; No Evidence of Misuse
HARTFORD, CT — The Connecticut Department of Social Services (DSS) today announced that Gainwell Technologies, the state's fiscal agent and account administrator for the Connecticut Medicaid program (HUSKY), became aware of unauthorized access to certain payment accounts on the HUSKY provider portal on June 25, 2026. On June 18, 2026, the unauthorized third party first gained access to a provider's reimbursement account and obtained certain claims and payment information for approximately 41,000 HUSKY members.
DSS and Gainwell have determined that the unauthorized access did not compromise electronic health records, Social Security numbers, or financial account information. DSS and Gainwell determined that, while the impacted information varied by individual, in the aggregate this incident involved: full name; identification number associated with the provider’s payment account or Medicaid claim; dates of medical services; information about services received and how they were billed; payment information, including amounts paid; and information about applicable non-Medicaid health insurance, including policy and group number. The unauthorized individual's activity appeared financially motivated rather than directed at obtaining patient data. Upon becoming aware of this activity, Gainwell took steps to secure the provider portal and enhance the overall security of the provider portal.
"Patient safety and privacy are paramount," said Commissioner Andrea Barton Reeves. "We take this incident seriously and are grateful that Gainwell's swift action contained the breach. We continue to work closely with our contractor, cybersecurity experts, and law enforcement to investigate fully and strengthen our security protections."
DSS and Gainwell are working with external cybersecurity experts and state and federal law enforcement to investigate and resolve the incident. Additional security controls have been deployed to enhance the overall security posture of the provider portal. On August 21, 2026, DSS and Gainwell began notifying affected individuals via postal mail. The notification includes an offer of credit and identity monitoring services and certain fraud support services. Individuals who believe they may be impacted are encouraged to call 1-866-200-0986 for more information.