Health Plans, Inc. notified individuals in September 2026 that a security incident may have exposed their personal health information. The exact data types and breach timeline have not been publicly disclosed. Affected clients should enroll in the free IDX credit monitoring offered in their notification letter and consider placing a credit freeze as a precaution.
| Company | Health Plans, Inc |
|---|---|
| Industry | Healthcare |
| Data Types Exposed | Personal Health Information, Names and Contact Details, Health Plan Member Information, Social Security Numbers |
| People Affected | Not Publicly Disclosed |
| Attack Method | Unspecified/Unauthorized Access |
| Regulators Notified | Delaware Attorney General |
Were you affected by this breach?
You may be owed compensation.
Data breach victims can recover money for identity-theft losses, out-of-pocket costs, wasted time, and the ongoing risk of fraud — usually with no upfront cost, and no fee unless you win.
Check if you qualify — free reviewWhat Happened in the Health Plans, Inc Data Breach?
Health Plans, Inc, commonly known as HPI, recently notified individuals about a security incident involving their personal health information. The company filed a notice with the Massachusetts Attorney General’s Office as part of its September 2026 batch of data breach disclosures. This filing is currently the only public record describing the incident.
Details about the Health Plans Inc data breach remain limited. The version of the notification letter posted by Massachusetts is a template rather than a completed copy sent to a specific resident. As a result, the sections that would normally explain how the breach happened, when it started, and what data was involved all appear blank in the public filing.
Because the template is incomplete, the exact method behind the incident has not been confirmed. One unusual detail stands out, however. The letter references a separate company called Alegeus in connection with the response. Alegeus provides health benefit technology services, but the filing does not explain its role in this matter. It is unclear whether this reflects a vendor relationship or simply leftover language from a shared notification template.
No independent source reviewed for this report clarifies the Alegeus reference. Readers should treat it as an open question rather than a confirmed fact. HPI has not issued a separate public statement describing the root cause of the incident beyond what appears in the regulatory filing.
Who was affected?
The notification indicates that clients of Health Plans, Inc. may be affected. HPI administers health plan benefits, so those affected are likely plan members or policyholders whose information passed through the company’s systems.
The Massachusetts filing shows that one Massachusetts resident was notified. However, this number reflects only that state’s portion of the notice process. It is not a nationwide total, and the overall number of people affected across the country has not been publicly disclosed.
Because the letter is a generic template, additional details about the affected population, such as age range or geographic spread, are not available. If children or elderly members were included among HPI’s health plan clients, that detail has not been confirmed either way.
Anyone unsure whether they received an actual notice from HPI should check their mail and email carefully. A specific letter addressed to you would contain details not present in the public template version.
What Information Was Potentially Exposed?
HPI’s filing states that the incident may have affected the privacy of personal health information. Because the specific data fields in the public template are blank, the exact categories involved have not been confirmed in detail. Still, based on the nature of HPI’s business and the type of protective services offered, certain categories are reasonably associated with this kind of incident.
- Personal health information
- Names and contact details
- Health plan member information
- Possible government identification numbers, such as Social Security numbers
It is worth noting that HPI is offering credit monitoring and identity protection services. Companies typically provide this type of package when Social Security numbers or similarly sensitive identifiers may be involved. This is an inference based on the response offered, not a confirmed list of exposed data.
When health information is exposed, the risks extend beyond typical financial fraud. Thieves can use stolen health plan details to file false insurance claims or obtain medical services under someone else’s name. This type of medical identity theft can also contaminate a victim’s medical records with inaccurate information, which can affect future treatment decisions.
In addition, when identifiers like Social Security numbers are potentially involved, victims face a higher risk of traditional identity theft. This includes fraudulent credit applications, unauthorized bank account openings, and tax fraud. Because health information cannot be changed the way a password can, the exposure risk can linger for years after the initial incident.
What is the company doing?
According to its notification letter, HPI is offering affected individuals two years of complimentary credit monitoring and identity protection through IDX. Enrollment requires a personal code printed in each recipient’s letter, and that code expires on a date specified in the individual notice.
The letter explains that recipients must actively activate the monitoring service for it to work. It also notes that enrollment requires established credit and internet access. If someone becomes a victim of identity theft connected to this incident, IDX’s ID Care team will assign a specialist to help them resolve the issue.
HPI’s notification also walks recipients through standard protective measures. These include reviewing account statements, requesting free annual credit reports, and placing fraud alerts or security freezes. The letter lists contact information for the Federal Trade Commission and several state attorneys general offices as additional resources.
In addition to the Massachusetts filing, HPI has been confirmed to have filed a formal notification with the Delaware Attorney General. This indicates the company has pursued multi-state regulatory compliance related to this incident, though the full scope of its response beyond these filings has not been made public.
What Should Affected Individuals Do?
Enroll in Offered Identity Protection Services
If you received a letter from HPI, locate your personal enrollment code and sign up for the free IDX credit monitoring and identity protection services before the deadline expires. This step costs nothing and provides an extra layer of detection if your information is misused.
Because the service must be manually activated, simply receiving the letter is not enough. Take a few minutes to complete the enrollment process online or by phone. Keep a copy of your code in a safe place in case you need it later.
Consider a Credit Freeze or Fraud Alert
Given that Social Security numbers or similar identifiers may have been involved, placing a security freeze with Equifax, Experian, and TransUnion is a strong protective step. A freeze blocks new credit accounts from being opened in your name without your explicit approval.
Alternatively, you can place a fraud alert, which requires lenders to verify your identity before extending credit. This option is less restrictive than a freeze but still adds a meaningful layer of protection. Both options are free to set up and can be lifted later if needed.
Monitor Your Health Records and Insurance Statements
Because this breach may involve health plan information, it is wise to review your explanation of benefits statements closely. Look for medical services or claims you do not recognize, since this can be a sign of medical identity theft.
If you spot unfamiliar claims, contact your health plan provider right away to dispute them. Correcting inaccurate medical records early can help prevent complications with future treatment or insurance coverage.
Watch for Phishing Attempts Referencing This Breach
Scammers often use news of a data breach to craft convincing phishing messages. Be cautious of unexpected calls, texts, or emails that mention this incident or ask you to verify personal details.
Always use the phone number listed in your official HPI letter rather than one provided in an unsolicited message. This simple habit can prevent you from accidentally handing over sensitive information to a scammer.
Check Your Credit Reports Regularly
You are entitled to a free credit report every 12 months from each of the three major credit bureaus. Consider spacing out your requests so a new report arrives every four months, giving you ongoing visibility into your credit file.
Review each report for accounts, inquiries, or addresses you do not recognize. If you notice anything suspicious, report it to the bureau immediately and consider speaking with a data breach attorney about your legal options.
Get a Free Case Review
Tell us how this breach affected you. A data breach attorney will review your situation at no cost and with no obligation — it takes about two minutes.
More Information
Official data breach notification report (PDF) from Delaware Attorney General