Healthcare Interactive (HCIactive) data breach: HealthNow members' files copied in July 2025

Why did I get a letter from HCIactive?

HCIactive says it holds people's information because it provides administrative services to another organization. The filed letter leaves that organization's name as a blank field, filled in for each reader. Washington's record names one such client, HealthNow Administrative Services. The letter may therefore come from a company you never dealt with directly, about a plan or administrator you did. The guide to letters from companies you never dealt with explains how that happens.

What happened at HCIactive?

HCIactive says it became aware of suspicious activity on its computer network on or about July 22, 2025, secured its systems and investigated. It says it is not aware of any actual or attempted misuse, and has added technical security measures.

Date	What the letter and the regulators' records say
June 17, 2025	Breach date on the Washington and California records
July 8 to 12, 2025	Files copied, per the letter
July 22, 2025	HCIactive becomes aware of suspicious activity
September 22, 2025	Report submitted to HHS with 501 individuals
December 4 to 5, 2025	Notice recorded by California and posted by Texas; letter dated December 5
January 7, 2026	Washington notice (HealthNow Administrative Services)

The state records date the breach from June 17, 2025, three weeks before the copying window the letter gives. The documents do not explain the difference. HHS's figure of 501 was filed in September, before the state counts, and the list still shows it.

What information was involved?

The letter fills in each reader's items after the name. The state records give the categories:

Regulator	Information it records
Washington attorney general	Name; Social Security number; full date of birth; health insurance policy or ID number; medical information
Texas attorney general	Name; address; Social Security number; medical information; health insurance information; date of birth

How many people were affected?

Regulator	What it counts	Number
Washington attorney general	Washingtonians (HealthNow Administrative Services notice)	61,225
Texas attorney general	Texans	32,493
HHS Office for Civil Rights	Individuals affected (September 2025 filing)	501
Indiana attorney general	Total affected, as reported to Indiana	87,565
Indiana attorney general	Indiana residents	297

Indiana's attorney general also records a total across all states. Its 2025 report lists a notice from Healthcare Interactive sent on December 2, 2025, for a breach dated June 17, 2025, with 297 Indiana residents and 87,565 people affected in all. That is the same June 17, 2025 breach date the Washington and California records give.

What is HCIactive offering?

Credit monitoring through Cyberscout, a TransUnion company, for the number of months printed on each letter. People must enroll themselves within 90 days of the letter date. The letter also suggests reviewing explanation-of-benefits forms for care you did not receive.

Item	Detail from the letter
Provider	Cyberscout (TransUnion)
Length	Printed on each letter
Enrollment deadline	90 days from the December 5, 2025 letter
Help line	Printed on each letter

What the documents leave open

• Which health plans and administrators besides HealthNow used HCIactive, and how many people each covers.
• How the actor got in, and why the state records give June 17 as the breach date.
• Whether Indiana's total of 87,565 is the full count. HHS still lists 501.

The HHS ranking and the HIPAA breach notification rule explain how business associates like HCIactive report.