2 min read

Union health fund hit by data breach affecting members’ personal and medical data

Tshedimoso Makhene Dec 25, 2025 8:59:24 AM

Breaches

Union health fund hit by data breach affecting members’ personal and medical data

A major data breach at the North Atlantic States Carpenters Health Benefits Fund (NASCBF) has exposed sensitive personal and health information of beneficiaries, triggering investigations and potential class action claims.

What happened

According to Claim Depot, the North Atlantic States Carpenters Health Benefits Fund (NASCBF) detected unusual activity within its network on August 18, 2025, prompting the organization to reset passwords and outsource forensic specialists. The investigation confirmed that an unauthorized actor accessed or obtained files stored on the NASCBF network during the incident. Claim Depot reports that the fund later disclosed the breach to the U.S. Department of Health and Human Services on October 17, 2025, classifying it as a hacking/IT security incident.

Going deeper

Preliminary notices and breach analyses indicate the breach may have exposed a broad range of personal and protected health information (PHI), including but not limited to:

Names and dates of birth
Home addresses
Social Security and tax ID numbers
Government-issued ID numbers
Financial account data and access codes
Medical and health insurance details
Login credentials

What was said

In an official notice of data event posted on the North Atlantic States Carpenters Health Benefits Fund’s website, NASCBF acknowledged the breach and outlined its response and advice to affected individuals. According to the notice, the fund described the incident, stating,

“On or about August 18, 2025, the NASCBF observed suspicious activity within the network of the Hamden, CT office.” The notice explains that NASCBF “promptly reset passwords, took measures to limit the impact of the incident, and started a forensic investigation with the assistance of third-party specialists.”

While confirming unauthorized access, the fund reassured members that “no funds were taken, and participants’ benefits and account balances with the NASCBF are fully intact.” It also outlined the types of data that may have been exposed and said the organization was still reviewing the affected files.

Emphasizing its priorities, NASCBF stated, “The confidentiality, privacy, and security of information within our care are among NASCBF’s highest priorities.”

The notice urged vigilance, advising members to monitor account statements and credit reports, and offered guidance on steps individuals can take to protect themselves, including enrolling in complimentary credit monitoring services if impacted.

The bigger picture

The NASCBF breach is part of a wider trend of cyberattacks hitting healthcare and benefits organizations, especially behavioral health providers. Both Wyandot Center and Oglethorpe, Inc. recently reported unauthorized network access that exposed sensitive personal and medical data.

All three organizations first detected unusual system activity and promptly engaged third-party forensic experts to investigate and secure their networks. The breaches involved access to data such as names, Social Security numbers, medical histories, and insurance details.

While no confirmed misuse of the data has been reported, these incidents indicate ongoing risks of identity theft and fraud for affected individuals. They also underscore the urgent need for stronger cybersecurity measures in healthcare and benefits sectors, where sensitive data remains a prime target for attackers.

FAQS

How can health funds detect signs of a potential breach within their systems?

Signs include unusual login activity, unexplained system slowdowns, unexpected file access or deletion, and alerts from cybersecurity software.

What immediate steps should a health fund take upon discovering a data breach?

Immediately contain the breach by securing affected systems, reset passwords, engage third-party forensic experts, and begin a thorough investigation to assess the scope and impact.