Connecticut Department of Social Services and Gainwell Technologies Notice of Data Security Incident

HARTFORD, CT - Gainwell Technologies ("Gainwell") provides fiscal agent and account administration services for the Connecticut Medicaid program ("HUSKY"), administered by the Connecticut Department of Social Services (DSS). On March 25, 2026, DSS and Gainwell learned that an unauthorized third party had gained access to a small number of Hartford HealthCare's payment accounts on the HUSKY provider portal website and downloaded certain files containing patient information from that website.

Upon becoming aware of this activity, DSS and Gainwell promptly launched an investigation with the support of external cybersecurity experts and in coordination with federal law enforcement. Through the investigation, DSS and Gainwell determined that the unauthorized activity began when the threat actor used compromised credentials of Hartford HealthCare employees to access Hartford HealthCare user accounts on the provider portal on March 4, 2026.

In response to this incident, DSS and Gainwell immediately took steps to secure the provider portal from further activity and terminate the unauthorized third party's access to the affected portion of the environment. DSS and Gainwell notified law enforcement and engaged external cybersecurity experts to assist with the investigation and response. The investigators have confirmed that the attack has been successfully contained and the unauthorized third party no longer has access to the portal.

DSS and Gainwell are also taking steps to implement additional security enhancements designed to mitigate the risk of future incidents.

External investigators have determined that the unauthorized third party's activities appeared to be financially motivated, rather than directed at obtaining patient data. Nevertheless, the unauthorized third party gained access to information relating to approximately 22,500 individuals. DSS and Gainwell determined that, while the impacted information varied by individual, in the aggregate this incident involved: full name; identification number associated with Hartford HealthCare account or Medicaid claim; dates of medical services; information about services received and how they were billed; payment information, including amounts paid; and information about applicable non-Medicaid health insurance, including policy and group number. This incident did not involve Social Security numbers or financial account information as that information is not available in the system to which the third party gained access.