Aetna

Summary

Aetna reported two data breach incidents involving unauthorized access or disclosure of member information, one affecting over ten thousand individuals and another affecting fewer than eight hundred, stemming from errors in a mailing distribution process; a separate phishing email incident allowed an outside party to access names, demographic details, medical provider names, health insurance and medication data. The company notified those affected, offered complimentary credit monitoring, and implemented enhanced safeguards and employee training to prevent recurrence.

Motives

Detailed motive labels are available to members.

TTPs

Detailed technique labels are available to members.

Description

On July 1, 2025, a phishing email allowed an outside party to gain access to certain Aetna members’ information. The accessed data included individuals’ names, demographic information, medical provider names, health insurance details, and medication information. Aetna announced in January 2026 that it had completed its investigation of this incident. Following the investigation, Aetna stated that it had implemented and enhanced safeguards and security measures to protect its email system. Additionally, Aetna rolled out enhanced employee training focused on recognizing and avoiding phishing emails.

Separately, Aetna filed two breach reports with the U.S. Department of Health and Human Services Office for Civil Rights on February 27, 2026. The reports described unauthorized access or disclosure incidents that had occurred during 2025 and were linked to mailings sent by Aetna on behalf of two health plans. An error in the mailing distribution process caused letters intended for members to be sent to recipients that may have included individuals not enrolled in the relevant health plan. One of the mailing‑related breaches affected 10,888 individuals, while the other affected 775 individuals. Aetna notified all affected individuals after discovering the incidents and offered them complimentary credit monitoring services. A CVS Health spokesperson said that Aetna had taken steps to address the mailing errors and to prevent similar occurrences in the future.

The spokesperson also emphasized that protecting the privacy and security of members’ information remains a top priority for Aetna. She noted that Aetna places the highest priority on safeguarding member data and regrets that these situations occurred.

Sources

Sources available to members: 1 source.