New York State Sen. Michael Nozzolio (R–Fayette) wants Excellus BlueCross BlueShield to provide answers to its customers following the breach that the health-insurance company reported on Sept. 9.
The breach may have affected the personal information of about 7 million Excellus customers. The same attack may have impacted an additional 3.5 million customers of additional affiliates of the Lifetime Healthcare Companies, Excellus’ parent company.
In a four-page letter to Christopher Booth, president and CEO of Excellus, Nozzolio said that Excellus’ public response “has not been sufficiently transparent, nor comprehensive.”
(Sponsored)
In a World of Complex Cyber Threats, Small Fixes Still Work
Cybersecurity headlines seem to get scarier by the week. Ransomware brings international airports to a standstill. Artificial intelligence is being used to supercharge phishing campaigns and discover new vulnerabilities. Nation-states
Asset Acquisition Strategies: Choosing Between Financing, Leasing or Buying
When acquiring business equipment or machinery, how you choose to pay can significantly impact your cash flow, tax strategy and long-term financial position. The three primary optionsare financing, leasing and
Nozzolio’s district includes six counties with “thousands” of Excellus customers, the lawmaker wrote.
Rochester–based Excellus is Central New York’s largest health insurer.
“Victims of this cyberattack simply have not been provided with adequate information about the scope and nature of the unauthorized access of their confidential personal and medical, nor have they been assured all necessary steps are being taken to prevent this from happening again,” Nozzolio wrote.
Nozzolio’s letter also asked Excellus to address eight questions about the breach.
For example, the lawmaker wondered how “such an extensive security lapse was able to exist undetected for nearly two years.”
Excellus indicated the initial attack happened Dec. 23, 2013, but it didn’t learn of the security breach until Aug. 5 of this year.
Nozzolio also wondered how the cybersecurity firm that Excellus retained discovered the attack and asked whether it pursues “periodic vulnerability assessments and penetration testing” prior to the attack. The state senator also asked for the status of the investigation into the breach and what it has uncovered about impacts on affected customers.
The lawmaker wants Excellus to clarify what groups of people and organizations are included in “others who have done business with the impacted plans,” which the health insurer referenced in its Sept. 9 news release on the cyber attack.
Contact Reinhardt at ereinhardt@cnybj.com
