Maryland insurance group reports massive data breach — 553,332 records exposed
A Maryland-based insurance group, Kelly & Associates Insurance Group, Inc., has filed a report with HHS OCR regarding a significant data breach. As a Business Associate, this entity handles protected health information on behalf of covered entities. The filing, submitted on April 9, 2025, indicates that a hacking/IT incident compromised data stored on a network server. The breach affects 553,332 individuals. Healthcare administrators should note this as a high-volume incident involving a vendor. While the submission date is April 9, the actual breach likely occurred earlier. This event highlights the risks associated with third-party data storage and the importance of monitoring vendor security practices.
Sources differ:
- The HHS OCR filing (cited here) lists 553,332 affected individuals; earlier notices filed with the Maine Attorney General reported smaller totals (32,234, then 263,893, then 413,032) before the count was revised upward to match the HHS figure. Government source