Kentucky's Cabinet for Health and Family Services disclosed on 19 October that Gainwell Technologies, a Medicaid programme vendor, suffered three separate intrusions — on 26 March, 16 April and 21 April 2026 — and did not discover them until August. On each occasion an unauthorised third party reached provider payment accounts on the KY Health-Net Provider Portal and downloaded files containing Kentucky Medicaid member information, with notifications to the estimated 3,816 affected people beginning on 16 October. The Cabinet says the exposed data did not include electronic health records, Social Security numbers or financial account information, but may have included full names, provider or claims identification numbers, dates of medical services, details of services received and how they were billed, payment amounts and non-Medicaid health-insurance policy and group numbers; it believes the intruder was seeking provider payment information rather than patient data. Gainwell holds a nearly US$34 million two-year contract for Medicaid programme reviews and has since added call-centre training on validating portal access requests plus further security enhancements. Why it matters: a state health programme inherits its payment vendor's detection gaps, here measured in months of unreported member billing data.

• Source article