Thousands of US military TRICARE beneficiaries are being notified after hackers gain access to TriWest Healthcare networks, exposing sensitive health information, including DoD Benefits Numbers and, in some cases, Social Security numbers.

Based in Arizona, TriWest Healthcare Alliance manages healthcare services on behalf of TRICARE for roughly four million beneficiaries across 26 states in the Western half of the US.

TriWest says that on April 16th, it discovered an “unauthorized person” accessed its systems and “downloaded some TriWest information.”

Now, the healthcare company is sending out breach notification letters to nearly 12,000 TRICARE beneficiaries, warning that their personal data may be at risk, the California State Attorney General's office database shows.

TRICARE is the overarching US military health care program for active-duty members, Veterans, and their families, while the US Department of Defense directly contracts TriWest to handle that region.

The Texas State Attorney General has also reported that at least 2,408 residents there have been identified as affected so far.

The July 2nd breach notice claims that "TriWest acted right away to prevent further access and hired an expert to help with our response."

Joseph Perry, Cybersecurity Researcher and Advanced Services Lead at Arcova, tells Cybernews that from his own firsthand experience in the military,

“personal data exposure happened so frequently that attempted identity theft became an annual occurrence.”

Unfortunately, Perry says that normalization is now part of the risk.

“When breaches become background noise, it is easy to overlook how each new exposure gives attackers another piece of information they can use,” Perry explains.

TriWest has not said how the intrusion occurred, if the attack was connected to ransomware, or why the breach notice was sent out almost three months after it became aware of the incident.

What information was involved?

According to the TriWest breach notice, 11,844 beneficiaries may have had their personal data exposed, including:

• Name
• Department of Defense Benefits Number
• ZIP code
• Type of authorization request (for example, physical therapy)

Furthermore, a report by the Air Force Times earlier this month revealed that in a limited number of cases, the exfiltratred data also included:

• Social Security numbers
• Addresses
• Dates of birth

Law firm Emery Reddy in Seattle, Washington – one of the states where TriWest members reside – says that government contractors have a legal obligation to safeguard sensitive personally identifiable information (PII) tied to a federal benefits program.

The law firm says a DoD Benefits Number can be used to commit health benefits fraud and that it can also link victims to sensitive military and health records – records that may reveal details about the kind of care a service member, Veteran, or family member was seeking.

“Once attackers know someone is part of a military family and uses Tricare, they know which organizations to impersonate, what language to use, and what types of requests may feel routine.”

says Perry.

Perry points out that accumulated information can make an attacker far more credible, and that even limited data is not harmless data.

“A message about healthcare coverage, military benefits, or an account issue is far more convincing when it arrives with personal context,” he says.

Perry also warns that attackers typically build credibility one detail at a time by combining information from breaches, public sources, and previous interactions to create a fuller identity profile.

“A name, ZIP code, or Department of Defense Benefits Number may be exactly what turns a generic scam into a believable one,” he says.

What TriWest is doing to protect victims

Perry reminds victims that even though containment may close the technical incident, it does not end the social-engineering risk.

“Military families should be cautious of unexpected messages about benefits, payments, password resets, or enrollment changes, particularly when the sender creates urgency or asks for credentials,”

Perry says.

TriWest is urging affected individuals to review their account statements for unusual activity and report anything suspicious to their bank or credit card companies right away.

And although TriWest says it is “unaware of any misuse" of the stolen information,” it is offering those beneficiaries 2 years of free identity monitoring with Experian.

The company is also encouraging those who sign up for the complimentary service to monitor their credit reports for fraud on a regular basis.

TriWest further said it has taken steps to beef up its security against future attacks, including increased security controls for network access resets, increased monitoring of its systems, and more training for employees on how to prevent cyber attacks.

The health management company noted it reported the incident to the appropriate authorities.