CA · AG Filing: Mar 21, 2025
No cost. No obligation. If your data was exposed by HealthEquity, Inc., you may be entitled to financial compensation.
Start Free Review →Based on the data types reported in this filing:
Your SSN is the master key to your identity. Once exposed, criminals can open new lines of credit, take out loans, or file taxes in your name.
Combined with a name and other leaked data, date of birth helps criminals pass identity verification questions at banks and government agencies.
HealthEquity, Inc. was the subject of a data breach notification filed with the CA Attorney General. The AG filing was recorded on March 21, 2025. The breach or discovery date reported in the filing is March 9, 2024.
From the AG filing description
HealthEquity, Inc. operates as a prominent financial technology and healthcare administration company, specializing in the management of Health Savings Accounts (HSAs), Flexible Spending Accounts (FSAs), Health Reimbursement Arrangements (HRAs), and other consumer-directed benefits. Because of its core business model, the company acts as a vital nexus between employers, health plans, and individual consumers, securely processing billions of dollars in medical transactions annually. This role requires HealthEquity to collect, store, and process an immense volume of deeply sensitive information, including comprehensive personal identifiers, intricate financial account details, sensitive medical treatment histories, and private health insurance data. The immense repository of financial and medical assets makes the company a high-value target for sophisticated cybercriminals seeking to monetize stolen data on the dark web. In 2025, HealthEquity, Inc. reported a significant cybersecurity incident to the California Attorney General, highlighting vulnerabilities within its digital infrastructure. While organizations in this sector typically deploy multi-layered security defenses, incidents of this magnitude often stem from sophisticated external network intrusions, unauthorized database access, or compromises within third-party vendor ecosystems. In the financial-healthcare technology sector, a breach of this nature usually indicates that malicious actors successfully bypassed perimeter security controls, potentially maintaining undetected access to internal systems for an extended period. Such intrusions allow unauthorized parties to infiltrate environments housing sensitive customer records, raising profound questions about the adequacy of the company's continuous monitoring, encryption standards, and threat detection mechanisms. The exposure resulting from this security failure compromises a highly toxic combination of financial and health-related data elements. Unauthorized access to full names, dates of birth, and Social Security numbers lays the immediate foundation for comprehensive identity theft and fraudulent credit applications. Furthermore, the exposure of specific health insurance identifiers, medical reimbursement claims, and treatment details creates severe risks of medical identity theft, where bad actors could fraudulently bill insurance providers or disrupt legitimate healthcare access. When combined with financial account numbers and routing details associated with HSA and FSA disbursements, victims face immediate exposure to financial account takeover, unauthorized fund transfers, and complicated tax reporting discrepancies. Each exposed data point acts as a building block for financial ruin and ongoing privacy violations. As an administrator of tax-advantaged health accounts and sensitive financial assets, HealthEquity, Inc. is bound by stringent regulatory frameworks, including the Gramm-Leach-Bliley Act (GLBA), portions of the Health Insurance Portability and Accountability Act (HIPAA), and robust state-level consumer protection statutes such as the California Consumer Privacy Act (CCPA). These legal frameworks impose strict affirmative duties on financial and healthcare administrators to implement rigorous administrative, physical, and technical safeguards to protect consumer data. The occurrence of a data breach of this scale strongly suggests a failure to meet these foundational legal obligations, particularly regarding timely software patch management, network segmentation, vendor risk management, and the deployment of advanced intrusion detection protocols. Receiving an official data breach notification letter from HealthEquity, Inc. serves as formal legal acknowledgment that your highly sensitive personal, financial, and medical information has been compromised due to corporate negligence. Under modern data privacy jurisprudence, the receipt of this letter establishes the legal standing necessary to participate in a class action lawsuit aimed at holding the company accountable. Importantly, affected individuals are not required to demonstrate immediate financial loss or actual identity theft to seek legal redress; the increased, imminent risk of future harm and the loss of privacy are actionable injuries under the law. Our firm investigates and litigates these data breach matters on a strict contingency fee basis, meaning you pay absolutely nothing out of pocket, and we recover attorney fees only if we successfully secure a financial recovery on your behalf. As a major player in the consumer-directed benefits industry managing millions of accounts nationwide, a security failure at HealthEquity, Inc. has far-reaching implications for market stability and consumer trust. The sheer density of financial and medical records concentrated within their platforms means that a single breach exposes a vast population to concurrent financial and healthcare vulnerabilities. This massive exposure underscores why corporate accountability is paramount; organizations that profit from managing our most sensitive life data must be held to the highest standard of vigilance, and legal action remains one of the most effective mechanisms to compel systemic cybersecurity reform.
You may have been affected by the HealthEquity, Inc. data breach if:
Common categories of compensation in data breach class actions
The hours spent responding to a data breach — canceling accounts, contacting credit bureaus, updating passwords, and investigating fraud — represent compensable economic harm in data breach litigation.
Once your SSN is exposed, protection becomes an ongoing expense. Plaintiffs in data breach settlements have recovered costs for credit freezes, identity protection subscriptions, and time spent dealing with fraudulent accounts — sometimes covering multiple years of exposure.
HIPAA violations carry civil penalties between $100 and $50,000 per violation. Where a healthcare organization's negligence led to the exposure of protected health information, class members may recover statutory damages in addition to actual losses.
Fees charged to close and reopen accounts, issue replacement cards, or dispute fraudulent transactions are recoverable in data breach litigation. So are the costs of overdrafts, late payments, and credit damage caused by unauthorized activity.
Several state data breach laws provide for statutory minimum damages — fixed amounts recoverable per affected individual regardless of actual loss. These provisions exist specifically to make legal action viable for victims who have not yet experienced direct harm.
Note: an attorney general breach filing does not by itself establish a settlement fund, a payment amount, or a claim deadline. If an official settlement notice is later issued, rely on that notice for payment details and deadlines.
Applicable State Law
This breach was reported under the California Consumer Privacy Act (CCPA), which mandates notification and establishes your right to seek damages.
No. Under California Consumer Privacy Act (CCPA) and federal law, the unauthorized exposure of your personal data — regardless of whether it has been actively misused — can be sufficient grounds for a claim. The breach itself is the injury.
Nothing. The Law Office of David S. Harris handles data breach cases on contingency — you pay zero upfront and owe nothing unless compensation is recovered.
Immediately place a free credit freeze at all three bureaus (Equifax, Experian, TransUnion). A freeze blocks new accounts from being opened in your name. Then file a complaint with the FTC at IdentityTheft.gov and contact our office — SSN exposure is one of the most serious breach types.
If HealthEquity, Inc. is a covered healthcare entity or business associate under HIPAA, affected patients have additional rights — including the right to an HHS complaint. These HIPAA violations also strengthen civil damages claims. Consult an attorney to understand your full remedies.
Banks may reverse fraudulent charges, but they are not obligated to compensate you for time lost, stress, or indirect damages. A class action claim against the breached company can recover those additional categories of harm.
Statutes of limitations for data breach claims vary by state but typically run 2–4 years. Depending on when you learned of the breach, you may still have time. Contact our office for a free eligibility review — there is no cost to find out.
Accepting free credit monitoring from HealthEquity, Inc. does not waive your right to pursue legal action unless you signed a specific release waiving claims. In most cases, victims who accepted monitoring can still file.
Learn how to participate in the class action and what compensation you may be entitled to.
Join the Class Action →Use our verification tool to confirm your letter matches this official AG filing.
Verify My Notice LetterThis case file references a public filing made with the state filing in CA. This website is not affiliated with, endorsed by, or operated by any state government agency.
HealthEquity, Inc. breach?
Free case review · No fee unless you win