--- title: "Recommended Permanent(e) Changes for Healthcare Organizations: The Kaiser & Change Healthcare Breaches" description: Kaiser Permanente's recent data breach exposed 13.4 million individuals' personal health information due to third-party trackers, highlighting the importance of data security and privacy measures. image: https://vorlon.io/hubfs/Bite%20Sized%20Breaches%20(y).png --- [Saas Security Blog](https://vorlon.io/saas-security-blog) > Recommended Permanent(e) Changes for Healthcare Organizations: The Kaiser & Change Healthcare Breaches # Recommended Permanent(e) Changes for Healthcare Organizations: The Kaiser & Change Healthcare Breaches [Lauren Lee](https://vorlon.io/saas-security-blog/author/lauren-lee) | May 01, 2024 [![Share on linkedin](https://vorlon.io/hubfs/ll-assets/Images/Icons/LinkedIn.svg) ](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Fa-permanente-mark-kaisers-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://vorlon.io/hubfs/ll-assets/Images/Icons/X.svg) ](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Fa-permanente-mark-kaisers-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Fa-permanente-mark-kaisers-data-breach%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=Recommended+Permanent%28e%29+Changes+for+Healthcare+Organizations%3A+The+Kaiser+%26+Change+Healthcare+Breaches) [![Share on email](https://vorlon.io/hubfs/ll-assets/Images/Icons/envelope.svg) ](mailto:?subject=Check%20out%20https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Fa-permanente-mark-kaisers-data-breach%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fvorlon.io%2Fsaas-security-blog%2Fa-permanente-mark-kaisers-data-breach%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Recommended Permanent(e) Changes for Healthcare Organizations: The Kaiser & Change Healthcare Breaches](https://vorlon.io/hs-fs/hubfs/Bite%20Sized%20Breaches%20(y).png?width=1200&height=820&name=Bite%20Sized%20Breaches%20(y).png) It has been a busy time for cybersecurity professionals in the healthcare space. Kaiser Permanente, one of the largest nonprofit health plans in the United States and a leading integrated managed care consortium, [recently disclosed a significant data security incident](https://www.bleepingcomputer.com/news/security/kaiser-permanente-data-breach-may-impact-134-million-patients/). This breach potentially impacts approximately 13.4 million current and former members and patients, raising concerns about the privacy and security of personal health information. Additional details have also come to light on the [Change Healthcare ransomware story](https://www.bleepingcomputer.com/news/security/change-healthcare-hacked-using-stolen-citrix-account-with-no-mfa/) as expertly reported by BleepingComputer.com's Bill Toulas.  ### Details of the KP Breach #### Extent of the Exposure According to a statement from Kaiser Permanente to BleepingComputer, the breach occurred due to third-party trackers on its websites and mobile applications. These trackers inadvertently leaked sensitive information to external entities such as Google, Microsoft Bing, and Social Media site X. The leaked data included IP addresses, names, and various interaction details with Kaiser’s digital platforms. #### Data Involved The specifics of the leaked information are concerning as they not only included IP addresses and names but also behavioral data such as account interactions, navigation details, and search terms used in Kaiser's health encyclopedia. Fortunately, no usernames, passwords, Social Security Numbers, financial account information, or credit card numbers were exposed. ### Response to the Incident #### Immediate Actions Taken Kaiser Permanente promptly responded to the discovery of the trackers by removing them and conducting a thorough internal investigation. The organization has implemented additional security measures to prevent similar incidents in the future. #### Notification and Caution While there is no evidence of misuse of the exposed data as of now, Kaiser Permanente plans to notify individuals who might have been affected. This proactive step is part of their commitment to transparency and customer care. ### Minimizing Data Sent to Third-Party Trackers #### Understanding Online Trackers Online trackers collect a wealth of information which often ends up in the hands of marketers, advertisers, and data brokers. This can lead to increased privacy risks for users. #### Steps to Protect Your Data Use Privacy-Focused Browsers: Opt for browsers that offer enhanced privacy settings and can block third-party trackers. Adjust Privacy Settings: Regularly check and adjust the privacy settings on your web browsers and mobile applications to limit the amount of data shared. Use Secure Connections: Employ VPNs or other secure methods to mask your IP address and reduce the risk of tracking. Educate Yourself and Others: Stay informed about how online trackers work and spread awareness to help others protect their privacy. ### Updates on Change Healthcare #### Extent of the Exposure Change Healthcare, a vital entity in the healthcare sector, faced a catastrophic blow in late February 2024 with a ransomware attack orchestrated by the BlackCat gang. The assault disrupted critical services, including payment processing and insurance claims, resulting in estimated financial damages of $872 million. #### **Data Involved** The breach was initiated by exploiting stolen Citrix remote access service, which did not have multi-factor authentication enabled. This led to the compromise of sensitive corporate and patient data. Although specifics were not disclosed, the breach encompassed a breadth of information, posing significant privacy risks. #### **Insights from CEO Testimony** Andrew Witty, CEO of Change Healthcare, provided invaluable insights into the attack's timeline and ramifications. He revealed the stealthy infiltration by threat actors ten days prior to encryption, underscoring the need for robust security measures. #### **Response to the Incident** Change Healthcare embarked on a swift remediation journey post-attack, characterized by decisive actions to fortify defenses and restore operational integrity. Despite the tumult, reassurances regarding the integrity of medical records provided a semblance of relief amidst the chaos. #### **Immediate Actions Taken** Following the attack, Change Healthcare implemented stringent security measures, including rebuilding infrastructure and fortifying defenses. These proactive steps aim to mitigate future vulnerabilities and restore trust in the organization's cybersecurity posture. ## Time for Check-Ups: Incident Response Plans The recent cybersecurity incidents at both Kaiser Permanente and Change Healthcare serve as reminders of the risks associated with third-party trackers and applications. These incidents also signal to every healthcare organization of the importance of robust data security practices. The time is now for the healthcare industry to give their incident response plans a quality check-up to ensure incidents involving third-parties are addressed with clear plans of action. Nothing is worse for a security team than not having a playbook or set of processes to follow when stress is high and literal lives are on the gurney. Information systems architectures heavily reliant on third-party applications require special expertise to ensure data privacy and protection. It is possible for organizations to reduce the risk of such breaches. This all starts with observability.  Every organization should have an incident response plan. We recommend leveraging our free [guide to third-party incident response preparedness](https://go.vorlonsecurity.com/third-party-incident-preparedness-white-paper), which is un-gated in our resources library.   #### Specifically For Citrix In the case of the stolen user credentials, Vorlon is able to collect Citrix users and their tokens. From there, Vorlon baselines normal access patterns, and raises an alert to abnormal activity such as unknown/new location or abnormal secret behavior. These serve as critical IOCs for the SOC to investigate and respond within a much faster timeline than allowing an attacker to go days, weeks, or months with this access. ### So, How Else Can Vorlon Help? Vorlon provides organizations with a continuous near real-time view of your data in motion between third-party applications, including Vorlon itself (since it is technically a third-party application as well).  Vorlon provides organizations with the ability to keep a detailed inventory of third-party apps, secrets, and sensitive data, so security teams can better understand their third-party attack surface and respond to incidents quickly.  In this case, organizations can use Vorlon for the following:  Scope and Investigate: - Detect if something abnormal is connecting to any of your third-party applications/entities, including unknown or suspicious IP addresses.  - Provide visibility into sensitive data or PII consumed by any unknown entities.  - Check API traffic for IOCs.  Remediate:  - Alert on anomalous API activity and provide response recommendations in near real-time (not days, weeks, or months after the abnormal activity occurs).  - Revoke and rotate affected secrets (including credentials, tokens, OAuth, etc).  - Create ITSM tickets for additional actions.  Continued Monitoring: - Behavioral alerting for further anomalous activity such as new secret creation and unknown source IP/geolocations. If you and your organization are worried about a possible third-party breach, [contact us here](https://go.vorlonsecurity.com/get-help) or call +1 (650) 456-2701. About the author ![Lauren Lee](https://vorlon.io/hs-fs/hubfs/Lauren%20Lee%20headshot%20clear%20bg.png?width=120&height=120&name=Lauren%20Lee%20headshot%20clear%20bg.png) [Lauren Lee](https://vorlon.io/saas-security-blog/author/lauren-lee) [Follow me on LinkedIn ](https://www.linkedin.com/in/laurenleeeee/) Lauren Lee is a Sales Engineer at Vorlon with eight years of cybersecurity experience. Before Vorlon, she held a variety of vendor and client-side technical cybersecurity positions, including roles at Palo Alto Networks, Cylance, the U.S. Department ... [Read Full Bio](https://vorlon.io/saas-security-blog/author/lauren-lee) Blog tags - [Breach Response](https://vorlon.io/saas-security-blog/tag/breach-response) [![ShinyHunters Sidebar Ad](https://vorlon.io/hs-fs/hubfs/Images%20-%202026/2026%20CISO%20Report%20Banner%20Ad%20Final.png?width=350&height=520&name=2026%20CISO%20Report%20Banner%20Ad%20Final.png) ](https://cta-service-cms2.hubspot.com/web-interactives/public/v1/track/click?encryptedPayload=AVxigLIFqhHbvMXr9sCtLg3SjGyxucXLDGAEZ6p7hVq%2FHj73J5jIl21ntspuXck0FDhLa5AoCVIiV6UPoFdmfyoCgk5gZhyQN0vNpJbQcKsyBPMqUuCsA79wUgKn%2BCq0jST2BYpRcl6MQO1nqRSUKrW04CR0pGt7umY8qquGOnnq3HJ0%2FYgVqp01i6ughr1Bd0ujJd4m2N8PUt6sJyfXCE46FwKHWOIg3dceObp%2BtoycGA%3D%3D&portalId=24426272) ### Related blogs [View all blogs](https://vorlon.io/blog) [![The Vercel Incident: OAuth Tokens and the AI Supply Chain Attack](https://vorlon.io/hs-fs/hubfs/vercel%20breach%20blog.png?width=400&height=300&name=vercel%20breach%20blog.png) Breach Response ### The Vercel Incident: OAuth Tokens and the AI Supply Chain Attack 7 min read Read More ](https://vorlon.io/saas-security-blog/vercel-incident-oauth-tokens-ai-supply-chain) [![Anodot Breach Exposes Snowflake Customer Data, Including Rockstar Games](https://vorlon.io/hs-fs/hubfs/anodot%20breach.png?width=400&height=300&name=anodot%20breach.png) Breach Response ### Anodot Breach Exposes Snowflake Customer Data, Including Rockstar Games 3 min read Read More ](https://vorlon.io/saas-security-blog/anodot-snowflake-breach-shinyhunters-data-theft) [![Mandiant Research on ShinyHunters Vishing: Why MFA-enabled Doesn’t Mean Protected](https://vorlon.io/hs-fs/hubfs/mandiant%20research%20shinyhunters%20vishing.png?width=400&height=300&name=mandiant%20research%20shinyhunters%20vishing.png) Breach Response ### Mandiant Research on ShinyHunters Vishing: Why MFA-enabled Doesn’t Mean Protected 5 min read Read More ](https://vorlon.io/saas-security-blog/mandiant-research-shinyhunters-vishing-mfa) [![How the Gainsight Breach Exposed a Growing SaaS Supply Chain Threat](https://vorlon.io/hs-fs/hubfs/Gainsight%20Breach.webp?width=400&height=300&name=Gainsight%20Breach.webp) Breach Response ### How the Gainsight Breach Exposed a Growing SaaS Supply Chain Threat 9 min read Read More ](https://vorlon.io/saas-security-blog/the-gainsight-breach-and-saas-supply-chain-attacks) ## Featured resources [![CISO Report Resource Tile](https://vorlon.io/hs-fs/hubfs/CISO%20Report%20Resource%20Tile.webp?width=1548&height=1046&name=CISO%20Report%20Resource%20Tile.webp) WHITE PAPERS AND RESEARCH ### The Agentic Ecosystem SecurityGap: 2026 CISO Report Why 99% of Organizations Were Breached Through Their SaaS and AI Ecosystem Despite Record Security Investment Read more ](https://go.vorlon.io/vorlon-2026-ciso-report-agentic-ecosystem-security-gap) [![blog 451 why saas and ai are converged (1)](https://vorlon.io/hs-fs/hubfs/Images%20-%202026/blog%20451%20why%20saas%20and%20ai%20are%20converged%20(1).png?width=329&height=222&name=blog%20451%20why%20saas%20and%20ai%20are%20converged%20(1).png) SaaS Security ### 451 Research: Why AI and SaaS Security Are Converging 451 Research highlights how AI and SaaS security are converging. Learn why integrations, OAuth, and ecosystem-level risk now define enterprise security. Read more ](https://vorlon.io/saas-security-blog/451-research-ai-saas-security-convergence) [![datamatrix patent blog](https://vorlon.io/hs-fs/hubfs/datamatrix%20patent%20blog.png?width=1548&height=1046&name=datamatrix%20patent%20blog.png) ### DataMatrix™: Vorlon's Patented Approach to Agentic Ecosystem Security Vorlon's DataMatrix™ technology is now patented. Learn how this intelligent simulation engine secures the agentic ecosystem by mapping AI agents, SaaS integrations, and data in motion. Read more ](https://vorlon.io/saas-security-blog/datamatrix-vorlons-patented-technology) ## Get Proactive Security for Your Agentic Ecosystem Book a Demo [![Vorlon_Logo_Large_White](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/Vorlon_Logo_Large_White.png?width=139&height=33&name=Vorlon_Logo_Large_White.png) ](https://vorlon.io) ## Sign up for industry insights and Vorlon news Start Here - [The Agentic Ecosystem Security Gap](https://vorlon.io/problems-we-solve) - [The Agentic Ecosystem Signal to Action Layer](https://vorlon.io/our-solution) Platform - [Platform](https://vorlon.io/platform) - [AI Agent Runtime Security](https://vorlon.io/ai-runtime-security) - [Total Identity Security](https://vorlon.io/total-identity-security) - [Data-Centric SaaS Security](https://vorlon.io/data-centric-saas-security) - [Compliance Automation](https://vorlon.io/compliance-automation) - [Apps Directory](https://vorlon.io/app-directory) - [SecOps Integrations](https://vorlon.io/integrations) Company - [About](https://vorlon.io/about) - [Careers](https://vorlon.io/careers) - [Press Room](https://vorlon.io/press-room) - [Resources](https://vorlon.io/resources) - [Blog](https://vorlon.io/blog) Let's Connect - Talk to Sales ![soc-type-2](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/soc-type-2.jpg?width=105&height=50&name=soc-type-2.jpg)![aws logo cropped](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/aws%20logo%20cropped.png?width=50&height=50&name=aws%20logo%20cropped.png)![latio innovators on black](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/latio%20innovators%20on%20black.png?width=52&height=50&name=latio%20innovators%20on%20black.png)![2025-CRN-Stellar-Startups](https://vorlon.io/hs-fs/hubfs/Logo/2025-CRN-Stellar-Startups.webp?width=29&height=50&name=2025-CRN-Stellar-Startups.webp)![FS-ISAC-Seal_Affiliate_onblack](https://vorlon.io/hs-fs/hubfs/ll-assets/Images/FS-ISAC-Seal_Affiliate_onblack.png?width=156&height=50&name=FS-ISAC-Seal_Affiliate_onblack.png) © 2026 Vorlon Inc. All rights reserved. - [Terms of Use](https://vorlon.io/terms-of-use) - [Privacy Policy](https://vorlon.io/privacy-policy) - [Sitemap](https://vorlon.io/sitemap) [![ClickCease](https://monitor.clickcease.com/stats/stats.aspx)](https://www.clickcease.com) ```json { "@context" : "https://schema.org", "@type" : "BlogPosting", "author" : { "@type" : "Person", "name" : "Lauren Lee", "url" : "https://vorlon.io/saas-security-blog/author/lauren-lee" }, "dateModified" : "2026-02-06T06:32:34.723Z", "datePublished" : "2024-05-01T17:31:15.000Z", "headline" : "Recommended Permanent(e) Changes for Healthcare Organizations: The Kaiser & Change Healthcare Breaches", "image" : [ "https://vorlon.io/hubfs/Bite%20Sized%20Breaches%20(y).png" ], "mainEntityOfPage" : { "@id" : "https://vorlon.io/saas-security-blog/a-permanente-mark-kaisers-data-breach", "@type" : "WebPage" }, "publisher" : { "@type" : "Organization", "logo" : { "@type" : "ImageObject", "url" : "https://vorlon.io/hubfs/Logo/Vorlon%20logo_two%20tone%20light.svg" }, "name" : "Vorlon Inc." } } ```