CT Department of Social Services and Gainwell Technologies Notice of Data Security Incident

HARTFORD, CT - Gainwell Technologies (“Gainwell”) provides fiscal agent and account administration services for the Connecticut Medicaid program (“HUSKY”), administered by the Connecticut Department of Social Services (DSS). On March 25, 2026, DSS and Gainwell learned that an unauthorized third party had gained access to 22,500 individuals of Hartford HealthCare’s payment accounts on the HUSKY provider portal website and downloaded certain files containing patient information from that website. 

Through (their) investigation, DSS and Gainwell determined that the unauthorized activity began when the threat actor used compromised credentials of Hartford HealthCare employees to access Hartford HealthCare user accounts on the provider portal on March 4, 2026.

DSS and Gainwell immediately took steps to secure the provider portal from further activity and terminate the unauthorized third party’s access to the affected portion of the environment. DSS and Gainwell notified law enforcement and engaged external cybersecurity experts to assist with the investigation and response. The investigators have confirmed that the attack has been successfully contained and the unauthorized third party no longer has access to the portal. 

DSS and Gainwell are also taking steps to implement additional security enhancements designed to mitigate the risk of future incidents. 

External investigators have determined that the third party’s activities appeared to be financially motivated. DSS and Gainwell determined that, while the impacted information varied by individual, in the aggregate this incident involved: full name; identification number associated with Hartford HealthCare account or Medicaid claim; dates of medical services; information about services received and how they were billed; payment information, including amounts paid; and information about applicable non-Medicaid health insurance, including policy and group number.  

On May 22, 2026, DSS and Gainwell began notifying affected individuals via postal mail. The notification includes an offer of credit and identity monitoring services and certain fraud support services. Individuals who believe they may be impacted are encouraged to call 1-855-744-4488 for more information.