Imagine360 Data Breach Details
The breach occurred on May 10, 2024, and May 16, 2024, but was not identified until months later, raising concerns about data security protocols and response times.
According to Imagine360, an employee’s email account was accessed without authorization on two separate occasions in May 2024. The company launched an investigation upon discovering the breach and conducted a comprehensive review of the affected emails. Although there is no evidence that the emails were downloaded or copied, the exposure of sensitive information remains a significant privacy risk.
History of Previous Data Breaches
Imagine360 has previously been targeted in cybersecurity incidents. In 2023, the company suffered two separate breaches involving its file-sharing platforms.
The first incident occurred around January 30, when unusual activity was detected within Imagine360’s Citrix file-sharing system, which is used to securely manage data related to self-insured health plans. In response, the company swiftly took the platform offline, reset passwords, and launched an investigation to assess the extent of the breach.
While investigating the Citrix breach, a second attack occurred through a separate file-sharing system, Fortra’s GoAnywhere Transfer solution. A previously unknown vulnerability in the platform was exploited by an unauthorized actor—later identified as the Clop ransomware group—who gained access and extracted sensitive information. Fortra confirmed that the breach was the result of a zero-day vulnerability being exploited.
In response to the recent breach, Imagine360 is offering affected individuals with free identity protection services for either one or two years. Instructions on how to activate these services are provided in the company’s official notification.
What Information Was Compromised?
The compromised data may include:
- Full names
- Social Security numbers
- Addresses
- Dates of birth
- Medical diagnoses and treatment details
- Health insurance information
