Medicaid records in Utah stolen by hackers

SALT LAKE CITY (AP) — Hackers downloaded approximately 24,000 Medicaid claims containing Social Security numbers and other personal information from the Utah Health Department over the weekend, sending officials scrambling to determine which clients were affected.

The information was contained on a new server at the agency, Utah Department of Technology Services spokeswoman Stephanie Weiss said Wednesday. Technicians had installed all the security tools — such as a firewall and password — but one of them was done improperly, she said.

Based on the hackers' IP address, or computer identity, the attack likely came from eastern Europe and began Friday evening, Weiss said. Downloading of claims began Sunday, and the server was taken offline Monday after the state's security software caught the attack.

Health Department officials are still trying to determine which clients were affected, spokesman Tom Hudachko said. The downloaded claims contained names, addresses, Social Security numbers, physician names and other personal information.

There is no way to narrow down the potential victims to a specific area of the state because the claims come from clinics throughout Utah, Hudachko said. Also, because providers have up to a year to file a claim, it is difficult to even narrow it down to recent patients.

While the investigation is ongoing, Hudachko said the department is recommending that every Medicaid client monitor credit reports, bank accounts and other areas the hackers could target with the information.

Clients whose information was accessed will be alerted as soon as the department determines what records were taken.

Although the attack appears to be isolated to the one server, Weiss said technicians are checking all of the other servers used by state agencies.