Alliant Health Plans Has Notified Certain Members

Alliant Health Plans has notified certain members that some protected health information (PHI) may have been affected by a security incident at Magellan MRx Management, a vendor contracted by the health plan to manage pharmacy benefits. On July 5, 2019, Magellan discovered that the email account of one of its employees had been sending out large volumes of spam email. An immediate investigation revealed that several unauthorized mailbox authentications and connections originating from outside the United States had been occurring on this employee's email account since May 28, 2019. It is believed that the unknown individuals were able to obtain the employee's email log-in credentials through a phishing attack or other fraudulent means. Alliant was alerted to the issue on September 30, 2019. Magellan believes that the intruder was attempting to access the account solely to send out spam emails and had no intentions to retrieve or view member data. However, Alliant is treating this incident as a breach because it could not be definitively determined any emails were accessed, viewed, or downloaded. Magellan has informed Alliant that it has taken steps to further secure all employee email accounts and has implemented enhanced protective measures related to email account log-ons and authentications beyond the systems which were already in place. Magellan also determined that none of its other systems experienced any unauthorized access aside from the impacted email accounts. Magellan provided a list of impacted members on November 4, 2019 and sent letters to notify them of the potential breach on November 22, 2019. The data that may have been exposed could have included the member's name, patient/member ID, type of service, authorization ID, and diagnosis. For more addition information, please email Incident@AlliantPlans.com or call Alliant's customer service team toll free at 800-664-8271, 9 AM to 5 PM Monday through Friday. 11-27/2019