Trusteed Plans Service Corporation (TPSC), a third-party administrator for Skagit County’s self-insured medical plans, experienced a data breach in December 2024 where an unauthorized user accessed its systems. The incident exposed sensitive personal and health-related data of 1,099 individuals, including current and former Skagit County employees and their dependents. Compromised information may include names, dates of birth, Social Security numbers, health insurance IDs, and claims data. TPSC notified Skagit County on August 8, and public disclosure followed on October 7. While no evidence of data misuse has been found, TPSC is offering support resources to affected individuals and has reported the breach to the U.S. Department of Health and Human Services and the Washington State Attorney General’s office. The breach underscores risks tied to third-party vendors handling sensitive employee health data, though no financial or operational disruptions to Skagit County were reported.
TPRM report: https://www.rankiteo.com/company/trusteed-plans-service-corporation
"id": "tru0862108100825",
"linkid": "trusteed-plans-service-corporation",
"type": "Breach",
"date": "12/2024",
"severity": "60",
"impact": "3",
"explanation": "Attack with significant impact with internal employee data leaks"{'affected_entities': [{'customers_affected': '1,099 (current/former employees '
'and dependents)',
'industry': 'Public Administration',
'location': 'Washington, USA',
'name': 'Skagit County',
'type': 'Government (County)'},
{'customers_affected': '1,099 (Skagit County health '
'plan members)',
'industry': 'Healthcare/Insurance',
'name': 'Trusteed Plans Service Corporation (TPSC)',
'type': 'Third-Party Administrator'}],
'customer_advisories': 'Direct notifications sent to 1,099 affected health '
'plan members.',
'data_breach': {'data_exfiltration': 'Likely (accessed by unauthorized user)',
'number_of_records_exposed': '1,099',
'personally_identifiable_information': ['Names',
'Dates of birth',
'Social Security '
'numbers',
'Health insurance '
'IDs'],
'sensitivity_of_data': 'High (includes SSNs, health data)',
'type_of_data_compromised': ['Personally Identifiable '
'Information (PII)',
'Protected Health Information '
'(PHI)']},
'date_detected': '2024-12',
'date_publicly_disclosed': '2025-10-07',
'description': 'A former third-party administrator of self-insured medical '
'plans for Skagit County employees, Trusteed Plans Service '
'Corporation (TPSC), experienced a data breach where an '
'unauthorized user gained access to its systems in December '
'2024. The breach was disclosed to Skagit County on August 8, '
'2025, and affects 1,099 health plan members, including '
'current and former employees and their dependents. '
'Compromised data may include names, dates of birth, Social '
'Security numbers, health insurance IDs, and health '
'plan/claims information. TPSC is notifying affected '
'individuals and offering support resources. No evidence of '
'misuse has been reported thus far.',
'impact': {'brand_reputation_impact': 'Potential reputational harm (notified '
'1,099 individuals)',
'data_compromised': ['Names',
'Dates of birth',
'Social Security numbers',
'Health insurance identification numbers',
'Health plan information',
'Claims information'],
'identity_theft_risk': 'High (PII and health data exposed)'},
'investigation_status': 'Ongoing (no evidence of misuse reported as of '
'2025-10-07)',
'references': [{'date_accessed': '2025-10-07',
'source': 'Skagit County Press Release'}],
'regulatory_compliance': {'regulations_violated': ['Potential HIPAA violation '
'(health data breach)'],
'regulatory_notifications': [{'agency': 'U.S. '
'Department '
'of Health '
'and Human '
'Services '
'(HHS)',
'status': 'Reported '
'by TPSC'},
{'agency': 'Washington '
'State '
'Attorney '
'General’s '
'Office',
'status': 'Notified '
'by Skagit '
'County'}]},
'response': {'communication_strategy': 'Direct notification to affected '
'individuals (via TPSC and Skagit '
'County); press release issued on '
'2025-10-07',
'incident_response_plan_activated': 'Yes (notification and '
'support resources '
'provided)'},
'stakeholder_advisories': 'TPSC and Skagit County notified affected '
'individuals; support resources offered (toll-free '
'numbers: TPSC at (888) 844-0928, Skagit County at '
'(888) 234-3144).',
'threat_actor': 'Unauthorized user',
'title': 'Data Breach at Trusteed Plans Service Corporation Affecting Skagit '
'County Employees',
'type': 'Data Breach'}