Kaiser Permanente notifies millions of its members of a privacy data breach

LOS ANGELES (KABC)– About 13.4 million current and former Kaiser Permanente members and patients were potentially affected by a privacy breach, the health care provider said.

Kaiser says it is alerting past and present customers and that the healthcare organization was not aware of any misuse of member or patient information.

Data possibly collected included IP addresses, member names, and how members navigated Kaiser’s website or mobile applications due to embedded code on those sites.

A cyber expert told ABC7 this case is more of a privacy violation than a data breach, in which criminals break into a system to steal and sell personal information.

“In the case of a privacy breach, as appears to be the case, this is a case where Kaiser shared personal data with other organizations, in this case potentially Twitter/X, potentially Google, potentially Microsoft,” said Dr. Clifford Neuman, director of the USC Center for Computer Systems Security.

In a statement to Eyewitness News, Kaiser Permanente said in part:

“No usernames, passwords, social security numbers, financial account information or credit card numbers were included in the transmission to these third parties. Kaiser Permanente conducted a voluntary internal investigation into the use of these online technologies and subsequently removed them from websites and mobile applications.

The organization apologized to its members, letting them know that it had taken safeguards and other measures to prevent this problem from happening again.