Endue Software reports hacking incident affecting 118,028 individuals
Benefits administrator Endue Software filed a breach report with HHS OCR on April 11, 2025, disclosing a hacking/IT incident that exposed data for 118,028 individuals. As a Business Associate, Endue is required to notify its covered entity clients, who must then notify affected patients. The breach occurred on a network server. If your organisation contracts with Endue for claims processing or other services, verify whether you have received notification from them. If you are a covered entity, ensure you have protocols in place to receive and act on such vendor notifications promptly. This filing date reflects when the report was submitted to HHS, not necessarily when the incident occurred or was discovered.
Sources differ:
- The HHS OCR filing does not describe Endue Software's business; other reporting (GovInfoSecurity) identifies it as a developer of software for medication infusion therapy, not a benefits administrator.
- The HHS OCR record reflects only the initial April 2025 breach report; HIPAA Journal and Top Class Actions report that Endue Software later agreed to an $870,000 class-action settlement, with a claims deadline of June 30, 2026.