Industry - Data Breach
Executive Summary
TriWest Healthcare Alliance disclosed that an unauthorized person gained access to and downloaded protected health information of 11,844 TRICARE beneficiaries on April 16, including names, Department of Defense Benefits Numbers, and ZIP codes, with fewer than five cases also involving Social Security numbers, addresses, and dates of birth. The company discovered the security incident and notified affected beneficiaries approximately two and a half months later, offering 24 months of free cred...
What Happened
On April 16, 2026, an unauthorized individual gained access to TriWest Healthcare Alliance systems and downloaded protected health information belonging to 11,844 TRICARE beneficiaries. The downloaded data included names, Department of Defense Benefits Numbers, and ZIP codes for all affected individuals, while fewer than five cases also involved Social Security numbers, physical addresses, and dates of birth. TriWest discovered the security incident on April 16 and began notifying affected beneficiaries approximately two and a half months later, with notification letters dated as early as July 2, 2026.
Who Is Affected
The breach affected 11,844 TRICARE beneficiaries in the Tricare West Region, which is managed by TriWest Healthcare Alliance and serves approximately four million beneficiaries total. Affected individuals include active duty service members, retirees, National Guard and Reserve members, their family members, survivors, and certain former spouses whose eligibility is determined through the Defense Enrollment Eligibility Reporting System. A very small subset of fewer than five individuals had more sensitive data exposed, including Social Security numbers, full addresses, and dates of birth.
Why It Matters
This incident compromises the personal and health information of military-connected individuals who rely on government-contracted health services, potentially exposing them to identity theft and fraud. The breach highlights ongoing vulnerabilities in third-party contractors handling sensitive government health data, particularly concerning password reset processes that TriWest subsequently strengthened. The approximately two-and-a-half-month gap between the April discovery and July notification raises questions about incident response timelines, even when following applicable legal requirements.
What You Should Do
If you received a notification letter from TriWest, enroll in the free 24-month Experian credit monitoring service using the activation code and instructions provided, ensuring you meet the deadline specified in your letter. Monitor your financial accounts and credit reports regularly for suspicious activity, and if you detect any unauthorized use of your information, contact the TriWest Healthcare Alliance Breach Response Line at 1-833-918-1296. If you believe you are a victim of identity theft, file a report with the Federal Trade Commission at identitytheft.gov and consider placing a fraud alert or credit freeze on your credit files with the three major credit bureaus.
Summary generated from verified sources and reviewed before publication. How we summarize.
Sources
- All About Women’s Care Data Breach Affects Up to 12,000 Patients - The HIPAA Journal
- TriWest Healthcare confirms data breach affecting 12,000 TRICARE beneficiaries - SC Media
- Ernst & Young warns clients after data breach exposed sensitive tax records - Cybernews
- Ernst & Young discloses data breach after support system hack
- Ernst & Young discloses data breach after support system hack - BleepingComputer