US Wellness Inc., a Maryland based company that runs biometric health screenings and flu shot clinics for health plans, notified Blue Cross Blue Shield of Arizona members in March 2023 that their information had been exposed in a breach at one of its own suppliers.
US Wellness said the supplier experienced a security incident on 31 January 2023 that disrupted access to certain systems, and that on 9 February it learned the incident had involved data belonging to members of the Arizona insurer, which trades as AZ Blue. The information involved included member names, addresses, dates of birth, member identification numbers, where a service originated and the address of the service location.
AZ Blue published its own notice on 21 March and US Wellness issued a public statement the following day. Both said there was no evidence that any information had been acquired or misused. US Wellness offered affected members two years of complimentary credit monitoring and identity protection through Experian IdentityWorks, and set up a dedicated telephone line and privacy mailbox for enquiries.
Neither company named the supplier at the time. HIPAA Journal subsequently reported that the incident stemmed from the compromise of Fortra's GoAnywhere managed file transfer software and that 11,459 AZ Blue members were affected.