Conifer Value-Based Care Breach: Phishing Exposes Patient Data

Conifer Value-Based Care Phishing Breach Exposes Patient and Guarantor Data Across Multiple States

Conifer Value-Based Care, LLC, a healthcare administration services vendor that provides administrative support to healthcare providers and health plans, disclosed a data breach after an unauthorized third party gained access to an employee's Microsoft Office 365-hosted business email account. The phishing attack occurred on August 28-29, 2025, and was discovered on August 28 -- the same day the unauthorized access began. But affected individuals did not receive notification letters until December 18, 2025, a gap of 112 days between discovery and disclosure.

The breach was filed with the California Attorney General, and state-specific notices were sent to residents of North Carolina and Oregon, indicating the exposure spans multiple jurisdictions. The number of affected individuals has not been publicly disclosed. Because Conifer serves as an intermediary -- processing data on behalf of healthcare providers and health plans -- the breach rippled outward from a single compromised email account to affect patients and guarantors who may have never heard of Conifer before receiving a notification letter in the mail.

The incident follows a pattern that has become dominant across the financial services and healthcare administration sectors: one phishing email, one employee credential, one email account, and a downstream data exposure that touches people who had no direct relationship with the compromised organization.

Timeline of Events

The timeline reveals a breach that was detected quickly but disclosed slowly.

August 28, 2025: An unauthorized third party gained access to an employee's Microsoft Office 365-hosted business email account. Conifer discovered the suspicious activity the same day. Same-day detection is a positive indicator -- it suggests monitoring controls on the email environment flagged the anomalous access.

August 29, 2025: The unauthorized access ended. The total window of exposure was approximately two days. Conifer's notification letter states that the compromised email account "is separate from Conifer's internal network and systems, which were not affected." The attacker reached the mailbox but went no further into Conifer's infrastructure.

November 10, 2025: Conifer completed its review of the compromised email account to determine what personal information was contained in the emails and attachments. This 74-day review period consumed the largest portion of the timeline. Email-based breaches are notoriously difficult to scope because sensitive data is distributed across thousands of individual messages and file attachments rather than stored in a structured database.

November 14, 2025: Conifer notified the healthcare providers and health plans it serves -- its upstream clients whose patients and members were affected. Because Conifer operates as a business associate under HIPAA, these covered entities needed to be informed before individual notifications could proceed.

December 5, 2025: Address verification was completed. Locating current mailing addresses for affected individuals is a routine but time-consuming step in the notification process, particularly when the affected population includes patients of multiple healthcare organizations across multiple states.

December 18, 2025: Individual notification letters were mailed. Both adult and minor notification letters were sent, indicating that children's information was among the exposed data. The notification included a dedicated support line (1-833-781-8318) and a response website at response.idx.us/VBCevent2025.

From discovery to individual notification: 112 days. From the end of the data review to individual notification: 38 days. The bulk of the delay was attributable to the data review itself, not to inaction after the review was complete.

What Data Was Exposed

The exposed data categories are focused on protected health information (PHI) and personal identifiers:

Names
Dates of birth
Addresses
Phone numbers
Email addresses
Medical information

The notification letter explicitly states that Social Security numbers, driver's license numbers, credit and debit card numbers, financial account numbers, and passwords were not involved in this breach. That carve-out narrows the immediate risk profile. There is no credit fraud exposure here, no financial account takeover risk, and no credential reuse concern.

But the absence of financial data does not make this a low-risk breach. Medical information combined with personal identifiers creates a distinct threat: medical identity fraud. An attacker who possesses a person's name, date of birth, address, and medical information can use that data to obtain healthcare services under the victim's identity, file false insurance claims, or obtain prescription medications fraudulently. Medical identity theft is harder to detect than financial fraud -- there is no equivalent of a credit monitoring alert for someone receiving treatment under your name -- and significantly harder to remediate. Correcting corrupted medical records can take years and may require legal action.

The inclusion of guarantor data adds another dimension. A guarantor is the person who agrees to pay a patient's healthcare bills, often a parent or spouse. Guarantor records may include financial responsibility information that, while not constituting full financial account data, could be used in social engineering attacks targeting the guarantor's relationship with the healthcare provider.

How the Attack Happened

The attack was a textbook business email compromise (BEC) via Microsoft 365. An unauthorized third party gained access to a single employee's cloud-hosted email account. The attacker accessed the mailbox for approximately two days. Conifer's internal network and other systems were not affected.

This attack pattern is the most common initial access vector in breaches across the healthcare and financial services sectors. The attacker does not need to breach a firewall, exploit a software vulnerability, or deploy malware. They need one set of stolen credentials -- obtained through a phishing email, credential stuffing, or purchase on a dark web marketplace -- and access to a cloud email platform that lacks phishing-resistant multi-factor authentication.

Microsoft 365 is ubiquitous in corporate environments, and its email accounts are high-value targets precisely because they often contain years of correspondence, attachments, and internal documents. An employee in a healthcare administration role may have emails containing patient records, provider correspondence, enrollment data, billing information, and guarantor details -- all accessible through a single compromised credential.

The pattern is not unique to Conifer. The Insurance Office of America breach originated from the same playbook: a phishing email gave an attacker five days of access to IOA's network, exposing 12,913 records. The Ameriprise Financial breach followed the same trajectory -- a phishing email impersonating a client compromised an advisor's access to 598 individuals' data. Diversified Benefit Services, an insurance marketing intermediary, disclosed an email system breach in August 2025 that exposed SSNs and medical data through the same email compromise technique. As we detailed in our IOA breach analysis, phishing attacks targeting email accounts in intermediary organizations produce outsized downstream impact because those accounts aggregate data from multiple clients.

The two-day access window in Conifer's case is short compared to the 35-day window at Texana Bank or the five-day window at IOA. But even two days is enough time for an attacker to search a mailbox, download attachments, and exfiltrate data -- particularly with automated tools that can pull every attachment from an inbox in minutes.

Who Is Affected

The affected population includes patients and guarantors of healthcare providers and health plans that use Conifer Value-Based Care for administrative services. Because Conifer operates as a business associate -- not as a direct healthcare provider -- the affected individuals had their data in Conifer's systems because their doctor, hospital, or health plan outsourced administrative functions to Conifer.

The breach affects individuals across multiple states. The filing with California's Attorney General and state-specific notices for North Carolina and Oregon confirm at least three jurisdictions. Given Conifer's role as an administrative services vendor, the geographic spread likely extends beyond these three states.

Children are among the affected population. Conifer prepared separate minor notification letters, indicating that pediatric patient data or data about dependents was present in the compromised email account. For parents and guardians, this means monitoring their children's identity and medical records -- a task complicated by the fact that children rarely have credit files to freeze and medical identity theft involving minors can go undetected for years.

The total number of affected individuals has not been disclosed publicly. The California AG listing and the Maine AG database do not include a specific record count for this breach.

Regulatory Implications

The Conifer breach triggers obligations under multiple overlapping regulatory frameworks, with HIPAA at the center.

HIPAA Breach Notification Rule (45 CFR 164.404): As a business associate under HIPAA, Conifer is required to notify the covered entities it serves -- the healthcare providers and health plans -- without unreasonable delay and no later than 60 days after discovering a breach of unsecured protected health information. Conifer notified its upstream covered entities on November 14, 2025, which is 78 days after the August 28 discovery date. That timeline exceeds HIPAA's 60-day notification window for business associates. The covered entities then have their own 60-day obligation to notify affected individuals, running from the date they are notified by the business associate. Whether Conifer's 78-day notification to covered entities constitutes a HIPAA violation depends on the specifics of the business associate agreements and whether any of the delay was attributable to law enforcement requests.

The HHS Office for Civil Rights (OCR), which enforces HIPAA, has been increasing its enforcement activity around breach notification timelines. OCR's breach portal tracks all breaches affecting 500 or more individuals, and settlements for notification failures have ranged from tens of thousands to millions of dollars depending on the scope of the violation.

California Civil Code Section 1798.82 requires notification "in the most expedient time possible and without unreasonable delay." California's statute applies to breaches involving personal information, which includes medical information combined with a name. The 112-day gap between discovery and individual notification may face scrutiny from the California Attorney General's office.

State-specific requirements: The inclusion of North Carolina and Oregon-specific notices reflects those states' individual notification requirements. North Carolina (N.C. Gen. Stat. 75-65) requires notification without unreasonable delay. Oregon (ORS 646A.604) mandates notification within 45 days of discovery for breaches affecting more than 250 Oregon residents.

The multi-state, multi-regulatory exposure is characteristic of breaches at healthcare business associates. A single email compromise at a vendor that serves providers across the country can trigger notification obligations in dozens of jurisdictions simultaneously.

The Bigger Picture

Business email compromise remains the single most effective initial access technique used against organizations in the healthcare and financial services sectors. The FBI's Internet Crime Complaint Center (IC3) reported that BEC attacks accounted for $2.9 billion in adjusted losses in 2023, making it the costliest cybercrime category by dollar value. Healthcare organizations and their business associates are prime targets because their email systems routinely contain the exact categories of data -- SSNs, medical records, insurance information -- that attackers seek.

The Conifer breach illustrates a structural problem in the healthcare vendor chain. Conifer serves healthcare providers, who serve patients. One compromised email account at one administrative vendor creates a data exposure that radiates outward across the entire care chain. The patients whose data was exposed did not choose Conifer, may not have known Conifer existed, and had no ability to evaluate Conifer's email security posture. Their data ended up in Conifer's email system because their healthcare provider outsourced administrative work, and that outsourcing decision cascaded the risk downstream to individuals.

Our breach tracker shows that vendor and intermediary breaches have become one of the defining patterns in recent filings. The Ameriprise breach analysis examined how phishing attacks against intermediaries produce outsized downstream harm. The same dynamic applies here: Conifer is a node in the healthcare data supply chain, and compromising that node exposes data from every provider and plan that feeds into it.

The Cybersecurity and Infrastructure Security Agency (CISA) has urged organizations to deploy phishing-resistant multi-factor authentication -- specifically FIDO2-based hardware security keys or passkeys -- rather than relying on SMS or app-based MFA that can be bypassed through SIM swapping, MFA fatigue attacks, or adversary-in-the-middle proxies. For Microsoft 365 environments in particular, conditional access policies that require phishing-resistant MFA and restrict sign-ins to managed devices represent the current best practice for preventing the exact type of compromise Conifer experienced.

The Verizon 2024 Data Breach Investigations Report found that credentials and phishing together account for over 80% of initial access in breaches involving web applications, which includes cloud-hosted email platforms like Microsoft 365. Until organizations treat email account security with the same rigor they apply to network perimeter defense, BEC attacks will continue to produce breaches like Conifer's.

Action Items

For affected patients and guarantors:

Call the dedicated support line at 1-833-781-8318 or visit response.idx.us/VBCevent2025 to access the resources described in your notification letter.
Monitor your Explanation of Benefits (EOB) statements from your health insurer. Look for claims for services you did not receive, providers you did not visit, or prescriptions you did not fill. These are indicators of medical identity theft.
Request a copy of your medical records from your healthcare provider and review them for entries that do not match your actual medical history. Under HIPAA, you have the right to request an accounting of disclosures and to request corrections to inaccurate records.
Place a fraud alert with one of the three major credit bureaus (Equifax, Experian, or TransUnion). Although financial account data was not exposed in this breach, the combination of name, date of birth, and address can still be used in social engineering attacks. A fraud alert adds a verification step when someone attempts to open credit in your name.
For parents and guardians of affected minors: Contact each credit bureau to check whether a credit file exists in your child's name. Children should not have credit files. If one exists, it may indicate identity theft. File a report with the FTC at identitytheft.gov if you discover any unauthorized activity.

For healthcare organizations using business associates for administrative services:

Review your business associate agreements (BAAs) to confirm they include specific requirements for email security controls, including phishing-resistant MFA, email data loss prevention rules, and defined notification timelines. Ensure notification obligations run from the date of discovery, not from the completion of the business associate's data review.
Conduct a data inventory of what information your business associates hold in their email systems. If patient records, enrollment data, or guarantor information flows through a vendor's email, that email environment is a PHI repository and should be secured accordingly.
Require evidence of email security controls from your business associates during annual risk assessments. Ask specifically about MFA type (phishing-resistant vs. SMS/app-based), conditional access policies, email encryption, and automated mailbox auditing.
Update your incident response plan to account for business associate breach scenarios. When your vendor is breached, your patients receive the notification letters. Your communications team needs a prepared response for inbound inquiries from patients who want to know why their data was at a company they have never heard of.