NY State Fines Dental Plan Firm $2M in Phishing Breach

Healthplex, Part of UnitedHealth Group, Lacked MFA on Compromised Email Account Marianne Kolbasuk McGee (HealthInfoSec) • August 18, 2025

New York State has fined a dental plan administrator owned by insurer UnitedHealth Group $2 million for failing to protect data with multifactor authentication and other issues related to a phishing breach that affected 90,000 people. It's the state's second fine against Healthplex for the same breach.

See Also: What Manufacturing Leaders Are Learning About Cloud Security - from Google’s Frontline

New York State Department of Financial Services announced the state's latest action against Uniondale, New York-based Healthplex on Thursday, saying that the company violated state cybersecurity regulations, including by failing to implement MFA for Office 365 email access from an external browser ...