Where does the Included Health case file come from?

Every entry is taken from the breach report Included Health lodged with the Massachusetts Attorney General. Nothing here is estimated.

Why do the incident date and the report date differ?

Companies usually investigate before they report. The gap between the two dates shows how long that took.

What does the records-affected figure count?

It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.

Does this case file change over time?

Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Case file

Case File: Included Health Data Breach

This file collects the dated facts on record for the Included Health incident. The state report is dated February 13, 2025.

Timeline

February 13, 2025Report filed in MassachusettsDate the notice was lodged with the Massachusetts Attorney General.

Case facts

Filing state: Massachusetts
Date reported: February 13, 2025
Receiving office: Massachusetts Attorney General

Case notes

Included Health, a company operating at the intersection of modern healthcare delivery and telemedicine, formally reported a data security incident to the Massachusetts Attorney General's office on February 13, 2025. The official filing indicates an unauthorized compromise within the company's network environment, though the specific nature and methods of the breach remain under investigation by the company.

While the exact categories of information involved in this incident have not been detailed in public records, Included Health maintains extensive repositories of deeply personal data for its patients. Therefore, the compromise of its network environment strongly suggests that sensitive personal information may have been accessed by unauthorized parties.

The exposure of such personal information can lead to various risks for affected individuals, including the potential for identity theft, fraud, or other unauthorized misuse of personal details. Given the sensitive nature of the services provided by Included Health, any compromised data could be particularly impactful for those affected.

Individuals who receive an official notification about this incident from Included Health should remain vigilant. It is generally recommended to regularly monitor financial accounts for any unusual or suspicious activity, review credit reports for unauthorized inquiries, and be cautious of unsolicited communications. Placing a fraud alert or security freeze on credit files can also serve as a protective measure against potential misuse of personal information following a data security incident.

Questions about this case file

Where does the Included Health case file come from?: Every entry is taken from the breach report Included Health lodged with the Massachusetts Attorney General. Nothing here is estimated.
Why do the incident date and the report date differ?: Companies usually investigate before they report. The gap between the two dates shows how long that took.
What does the records-affected figure count?: It is the number the company gave the state. It can cover residents of that state only, so the national total may be higher.
Does this case file change over time?: Yes. When a company files an update or a new state publishes its copy of the report, the dates and counts here are refreshed.

Massachusetts data breaches

Named in the Included Health breach?

Attach your notice and a short note. An attorney checks it against this case file at no cost.

Timeline

Case facts

Case notes

Questions about this case file

More Massachusetts case files