The security lapse occurred between September 22 and September 26, 2025, according to internal findings. The breach compromised a broad spectrum of personal data, including beneficiary numbers, policy identifiers, and specific diagnosis information. Those who received official notification from the company are now being urged to monitor their credit reports and account statements for suspicious activity.

Edelson Lechtzin LLP, a national class action firm based in Pennsylvania, has launched an investigation into the incident. Attorneys are currently evaluating potential legal claims for affected individuals, offering free consultations to those seeking to pursue remedies for the exposure of their sensitive health and financial data. The firm recommends that victims preserve all breach-related correspondence and consider placing fraud alerts on their financial profiles while the investigation proceeds.